Skip to content
MailVitals Email deliverability
Sign inEarly access
Orange (orange.fr and wanadoo.fr)

OFR_515: DMARC failed, rejected by your policy

Your message failed DMARC, and Orange rejected it because your domain's DMARC policy asks for that.

Orange
Provider
Sources checked
By , email deliverability consultant
Author

At a glance

Code
OFR_515
Who has to act
The sender. The fix is on the sending side: your domain, your server or your list.

What it means

Code 515 means DMARC authentication failed for your message and Orange rejected it as your DMARC policy defines. DMARC passes only when SPF or DKIM passes for a domain aligned with the From address; with a policy of reject, a failure means refusal. Orange requires SPF, DKIM and DMARC from all senders, and for large senders expects the From domain to match the authenticated domains. It points to the MxToolBox DMARC check and to SenderAudit for testing the configuration.

Common causes

  • The message was not DKIM signed with a domain aligned to the From address.
  • The sending server is not in the SPF record, or the envelope domain does not align.
  • A new sending service was added without updating SPF and DKIM.
  • Someone sent mail forging your domain.

How to fix it

  1. 01Check the SPF, DKIM and DMARC results of a rejected message.
  2. 02Sign with DKIM under the From domain and add every legitimate sender to SPF.
  3. 03Test the configuration with a DMARC checker or SenderAudit before sending again.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

  1. OFR_519Sending IP not authorised by SPF.Orange refused your mail because the sending IP is not authorised in your domain's SPF record to send for that domain.Orange
  2. OFR_535DKIM signature missing.Orange rejected your message because it carries no DKIM signature. Orange makes DKIM signing mandatory for mail sent to its users.Orange
  3. 554Rejected under the sender domain's DMARC policy.The message failed SPF and DKIM as DMARC requires, and the From domain publishes p=reject, so GMX rejected it as the domain owner asked.GMX, WEB.DEPermanent

Further reading

All 20 Orange codesEvery code in the wikiPaste your own bounce

Beat · paid monitoring

A heartbeat for your email.

Beat runs every check on this site on a schedule: 41 checks, 33 blacklists and real inbox placement. The moment something breaks, it tells you what broke, why it matters, and the exact fix.

Get early access to BeatSee what Beat watches
example.comWatching
  • SPFpass
  • DKIMpass
  • DMARCp=none
  • Blacklists0 of 33

Illustrative. Your domain, every few hours.

Also from us:Pulse: your own sending infrastructureConsulting: $65/hr, no retainer