550 5.7.64: relay not attributed to your tenant
Microsoft 365 could not match your on-premises server to an inbound connector, so it refused to relay its mail.
- Microsoft
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550 5.7.64
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 5.7.64 TenantAttribution; Relay Access Denied
What it means
When an on-premises Exchange server, or an IIS SMTP server, relays mail out through Microsoft 365, an inbound connector must identify it by the certificate it presents or by its IP address. 5.7.64 TenantAttribution means no connector matched, so Microsoft 365 could not attribute the traffic to your tenant. Microsoft's documented reasons are a certificate renewed under a different name, a server IP that changed, and a server that does not send its full certificate chain during the TLS handshake. Only an admin of the sending organization can fix it.
Common causes
- The certificate on the on-premises server no longer matches the certificate name on the inbound connector.
- The IP address on the connector no longer matches the server's address.
- The on-premises server does not send its intermediate certificates during the TLS handshake.
- The sender's domain is not verified in the Microsoft 365 tenant.
How to fix it
- 01Rerun the Hybrid Configuration Wizard and select the current certificate, which updates the inbound connector.
- 02Or edit the inbound connector so its TlsSenderCertificateName or IP addresses match the server, using the send connector logs to see the certificate actually presented.
- 03Import the intermediate certificates on the sending server so it presents the full chain.
- 04Make sure the domains you relay for are verified in Microsoft 365.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Fix NDR error "550 5.7.64" in Exchange Onlinelearn.microsoft.com
- "550 5.7.64 TenantAttribution" when sending mail externally in Microsoft 365learn.microsoft.com
- "550 5.7.64 TenantAttribution" when sending emails through Microsoft 365learn.microsoft.com
Related codes
- 5.4.1Server does not accept mail for this domain.The server that answered does not accept mail for the recipient's domain, which usually points to a wrong MX record or server setting.
- 550 5.7.750Sending from unregistered domains.The tenant sent a suspicious volume of mail from domains that are not added and verified in Microsoft 365, so Exchange Online blocked it.
- 450 4.4.317Remote server sends an incomplete certificate chain.During the TLS handshake the other server sent only its own certificate, and Exchange Online could not verify it against a trusted root.
Further reading
All 111 Microsoft codesEvery code in the wikiPaste your own bounce