450 4.7.26: IPv6 mail without an SPF or DKIM pass
Microsoft 365 refused a message that arrived over IPv6 because the sender passed neither SPF nor DKIM.
- Microsoft
- Provider
- Temporary (4xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 450 4.7.26
- Temporary or permanent
- TemporaryThe sending server keeps the message and tries again later.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
450 4.7.26 Access denied, a message sent over IPv6 … must pass either SPF or DKIM validation
What it means
Microsoft 365 sets extra conditions for anonymous mail that arrives over IPv6. Once a tenant has opted in to IPv6 delivery, the sending address needs reverse DNS and the sending domain must pass SPF or DKIM, or the message is turned away with this code. Microsoft's mail flow documentation shows it as 450 4.7.26 with a Service unavailable wording; its error table shows Access denied. It is a deferral, so the sending server retries, but every attempt over IPv6 fails the same way until authentication is fixed. The sender has to act.
Common causes
- The sending server's IPv6 address is not in the domain's SPF record.
- The message carries no DKIM signature, or one that does not verify.
How to fix it
- 01Add the sending server's IPv6 address or range to the domain's SPF record.
- 02Sign outgoing mail with DKIM for the sending domain.
- 03Send a test to a Microsoft 365 mailbox and check the Authentication-Results header for spf=pass or dkim=pass.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
- Mail flow in cloud organizations (support for anonymous inbound email over IPv6)learn.microsoft.com
Related codes
- 5.7.25IPv6 sender without reverse DNS.Microsoft 365 refused mail from an IPv6 address that has no reverse DNS (PTR) record; the same rule also appears as 450 4.7.25.
- 5.7.510Recipient domain does not accept IPv6 mail.You sent over IPv6 to a Microsoft 365 domain whose tenant has not opted in to receiving anonymous mail over IPv6.
- 450Mailbox temporarily unavailable.The server did not take the message for this mailbox for now, because the mailbox is busy or temporarily blocked by policy. The sending server will try again.
4.7.26 at other providers
- 451 4.7.26DMARC check hit a DNS failure.Gmail could not finish checking SPF and DKIM because a DNS lookup failed, and the From domain's DMARC policy says to reject mail that does not authenticate.
- 421 4.7.26Unauthenticated mail, rate limited.Gmail is slowing mail from you because this message passed neither SPF nor DKIM, and Gmail requires every sender to pass at least one.
Further reading
All 111 Microsoft codesEvery code in the wikiPaste your own bounce