5.7.509: DMARC failure with a reject policy
The domain in the From address failed DMARC and publishes p=reject, so Microsoft 365 rejected the message as the domain asked.
- Microsoft
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 5.7.509
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
5.7.509 Access denied, sending domain [$SenderDomain] does not pass DMARC verification…
What it means
DMARC checks that the domain in the From header (the RFC 5322 From) is backed by a passing SPF or DKIM result for that same domain. When it fails and the domain publishes a reject policy, Microsoft 365 honours the policy and returns 5.7.509. Microsoft names three common reasons: missing or incorrect DMARC and SPF records or alignment, a missing DKIM record or an unsigned message, and forwarding that breaks SPF or DKIM on the way. The bounce includes headers that show which check failed.
Common causes
- SPF passes for a different domain than the From address, so it does not align.
- The message is not DKIM-signed, or the DKIM public key is missing from DNS.
- The message was forwarded, and the forwarding broke SPF or DKIM.
How to fix it
- 01Read the Authentication-Results header in the bounce to see whether SPF, DKIM or alignment failed.
- 02Make sure every service that sends as your domain is covered by SPF and signs with DKIM for your domain.
- 03If you use a DMARC reporting service, check its reports for the failing source.
- 04If you are a user, send the bounce to your email admin.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
Related codes
- 550 5.7.515Outlook.com high-volume sender authentication.Outlook.com rejected mail from a domain that sends over 5,000 messages a day to it, because the mail did not pass SPF, DKIM and DMARC.
- 550 5.7.23SPF violation on outgoing mail.The destination checked SPF on mail sent from your Microsoft 365 organization and rejected it, which points to a problem in your SPF setup.
Further reading
All 111 Microsoft codesEvery code in the wikiPaste your own bounce