Skip to content
Microsoft (Outlook.com and Microsoft 365) · permanent error

5.7.520: automatic external forwarding blocked

Exchange Online stopped an automatically forwarded message because the organization's outbound spam policy blocks forwarding to external addresses.

Microsoft
Provider
Permanent (5xx)
Class
Sources checked
Author

At a glance

Code
5.7.520
Temporary or permanent
PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
Who has to act
The sender. The fix is on the sending side: your domain, your server or your list.
What the server says
5.7.520 Access denied, Your organization does not allow external forwarding.

What it means

When an inbox rule or mailbox forwarding sends messages on to an outside address, Exchange Online checks the outbound spam filter policy. If the policy blocks automatic external forwarding, the forwarded message is stopped and its sender gets this report, which ends with AS(7555). Since 2021 the default setting, Automatic - System-controlled, blocks external forwarding in new organizations, though some older ones still allow it. Microsoft notes that forwarding can disclose information to attackers, so many admins keep it off and allow it only for users who need it.

Common causes

  • A user set up an inbox rule, or an admin set up mailbox forwarding, to an outside address.
  • The organization's outbound spam policy blocks automatic forwarding to external recipients.

How to fix it

  1. 01Users: ask your admin whether forwarding to that address is allowed; if not, remove the rule.
  2. 02Admins: confirm the forwarding is legitimate and was not set up by an attacker.
  3. 03To allow it, apply a custom outbound spam policy with automatic forwarding turned on to the users who need it.
  4. 04Remote domain settings and mail flow rules can also block forwarding, so check them if messages are still stopped.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

  1. 550 5.7.367Forwarded mail rejected by the next hop.A message Microsoft 365 forwarded or relayed was refused by the next server, often a third-party gateway, because it left from Microsoft's relay pool.MicrosoftPermanent

All 111 Microsoft codesEvery code in the wikiPaste your own bounce

Beat · paid monitoring

A heartbeat for your email.

Beat runs every check on this site on a schedule: 41 checks, 33 blacklists and real inbox placement. The moment something breaks, it tells you what broke, why it matters, and the exact fix.

example.comWatching
  • SPFpass
  • DKIMpass
  • DMARCp=none
  • Blacklists0 of 33

Illustrative. Your domain, every few hours.

Also from us:Pulse: your own sending infrastructureConsulting: $65/hr, no retainer