550 5.7.515 Access denied: what it means and how to fix it
Microsoft refused your email because your domain’s settings don’t prove the email really came from you. Since May 5, 2025, Microsoft requires domains that send a lot of email (more than 5,000 a day) to Outlook.com, Hotmail and Live addresses to have three settings in place, and it bounces email that doesn’t meet them. Fix the settings and your email goes through again.
Check your own email first. Free, about 90 seconds. You get a grade and a plain-English list of what's working and what isn't.
The message you’re seeing
550; 5.7.515 Access denied, sending domain [your domain] does not meet the required authentication level.
Unlike a spam-folder problem, this is a hard “no”. The person never sees your email, and you get the bounce instead.
Why this happens
Your domain has three settings that vouch for your email: the approved senders list, the email signature, and the protection and reporting setting. Microsoft now expects all three for domains sending at volume. Usually one is missing, or one of the tools you send from isn’t approved on your domain yet.
What to do
- Run the free check below. It shows which of the three settings is missing.
- Look at the bounced email to see which tool sent it: your mailbox, your invoicing, your newsletter. That’s the one to fix first.
- Turn on the “verify your domain” setting in that tool, and add what it asks for where your domain is managed.
- Resend the email once the free check shows everything working.
What this guide can’t do for you
It covers the common causes. It can’t tell you which of your tools is the one that’s failing, or give you the exact settings for your business and the company that manages your domain. That’s what the Email Fix does. We check every tool that sends email for you and give you steps written for your setup. If we can't find what's wrong with your email settings, you get your $299 back. The guarantee covers your email settings. No settings can fix email sent to people who didn't ask for it, like bought lists or mass emails.
See what's wrong with your email, free
Type in your business's web address (the part after the @ in your email). You'll get a plain-English answer: what's working, what isn't, and what to do next.
Common questions
I don't send 5,000 emails a day. Why am I getting this?
Microsoft's announced rule is for domains sending more than 5,000 a day to its consumer addresses. Whatever the trigger, the fix is the same: get all three settings in place for every tool that sends as you.
Will it work if I just send the email again?
Not until the settings are fixed. Microsoft will keep rejecting it.
Does this affect Gmail too?
Gmail has its own version of the same rules. If Gmail is bouncing you, see our guide to the 550 5.7.26 error.
For your IT person or web developer
You can forward this page as it is. Everything below is written so someone who doesn't work with email settings every day can follow it.
Microsoft's Outlook.com (consumer) high-volume sender requirements, in force from May 5, 2025: SPF and DKIM must pass, and a DMARC record of at least p=none must exist and align with SPF or DKIM. Non-compliant mail is rejected with 550; 5.7.515.
1. Find where the domain's DNS is managed
Look up the domain's nameservers with any WHOIS or DNS lookup site. Nameservers ending in domaincontrol.com mean GoDaddy; ns.cloudflare.com means Cloudflare. Log in there and open the DNS settings for the domain (often labeled “DNS”, “Manage DNS” or “DNS records”). If the owner doesn't have the login, the renewal receipt email usually says which company it is.
2. SPF, DKIM and DMARC for every sending service
Click-by-click steps for each are in the business email going to spam guide. The important part is alignment: the domain in DKIM's d= or the SPF envelope domain must match the From domain.
3. Check it worked
DNS changes usually show within an hour, though some hosts take up to a day or two. Then send a test message to a personal Gmail address, open it, click the three dots at the top right of the message and choose Show original. You want to see SPF: PASS, DKIM: PASS and DMARC: PASS. You can also run the free check at senderfix.com again.
Related guides
Written by the SenderFix team. Last updated .