If you sent an email and got back a bounce message containing the code "email rejected 550 5.7.515," Microsoft blocked your message before it reached the customer. This is not a problem with their inbox or your internet connection. It is an email authentication failure, and there is a specific five-step fix for it.
Here is what the code means, why it is happening, and how to stop it.
What does error 550 5.7.515 mean?
Error 550 5.7.515 means Microsoft's mail servers rejected your outbound email because your sending domain failed its authentication check. Microsoft's support page gives the full bounce as: "550 5.7.515 Access denied, sending domain [yourdomain.com] does not meet the required authentication level." Some bounces word the ending as "does not meet sender requirements." Same code, same fix.
Microsoft began enforcing this check on May 5, 2025, for domains that send 5,000 or more messages a day to Outlook.com, Hotmail, and Live addresses. If you send at that volume and your emails started bouncing after spring 2025, that enforcement change is almost certainly why. According to Microsoft's official NDR guidance, the error is a hard bounce, meaning the message is undeliverable and the customer sees nothing.
You get the non-delivery report. They get silence.
Why is my domain failing authentication?
Three gaps cause the 550 5.7.515 error: a missing SPF record, DKIM signature, or DMARC policy that is not aligned with those two records.
SPF (Sender Policy Framework) is a DNS record that tells Microsoft which mail servers are authorized to send email as your domain. Without it, any server looks like a potential impersonator. DKIM (DomainKeys Identified Mail) is a cryptographic signature added to each message that proves it was not tampered with in transit. DMARC ties both together and tells the receiving server what to do when either check fails. For high-volume senders, a missing DMARC record now means rejection. Microsoft's support page for this error lists p=none as an accepted DMARC policy, so you can start without blocking anything.
The gap is widespread. A Parallax Intelligence check of 1,527 Southwest Michigan businesses found that 79.2% of the 847 that email from their own domain have no DMARC enforcement. 390 of those 847 (46.0%) publish no DMARC record at all, the record whose absence triggers this bounce for high-volume senders.
Is Microsoft enforcing this for all senders now?
No. Microsoft's May 2025 enforcement started with high-volume senders (5,000 or more messages per day to Outlook, Hotmail, or Live addresses). Domains sending that volume without SPF, DKIM, and DMARC get rejected outright. Below that volume, Microsoft's published 550 5.7.515 rule doesn't apply. Google has its own sender requirements: every sender needs SPF or DKIM, and senders of 5,000 or more messages a day also need DMARC. The bar is rising across the big inbox providers, so a domain with all three records in place is the safer spot at any volume.
How do I fix a 550 5.7.515 email bounce?
The fix follows a set sequence. Skipping steps or doing them out of order usually means the bounce continues. Most businesses with a single email provider can complete this in under an hour.
-
Check what is missing. Run your domain through the free email security scanner to see its SPF, DKIM, and DMARC status at a glance. Whatever shows up missing or broken is your to-do list for the next three steps.
-
Fix your SPF record. Add or update the DNS TXT record at your registrar. For Google Workspace, the value is "v=spf1 include:_spf.google.com ~all". For Microsoft 365, it is "v=spf1 include:spf.protection.outlook.com ~all". If you use another provider, they document the exact include. Only one SPF record is allowed per domain.
-
Enable DKIM signing. Both Google Workspace and Microsoft 365 have DKIM configuration inside the admin console. They generate a public key; you copy it into a DNS TXT record at your registrar. Allow 24 to 48 hours for DNS to propagate before testing.
-
Add a DMARC record. Start with "p=none" so you can observe the traffic without disrupting delivery: "v=DMARC1; p=none; rua=mailto:[email protected]". After a few weeks of clean reports, step up to "p=quarantine" or "p=reject" to enforce the policy.
-
Test and monitor. Send a test email to an Outlook or Hotmail address after DNS propagates. If it delivers, the fix worked. Read a few weeks of DMARC reports before stepping up enforcement.
If you send from multiple services such as a CRM, a billing tool, and a contact form, each one needs an SPF include and its own DKIM key. That is where most small businesses hit friction. The how to stop quotes going to spam guide covers the multi-sender setup in detail.
To check a bounce before you change anything, paste it into the free reader on the 550 5.7.515 page at postmortem.report. It runs in your browser and names the error. For other codes, the email rejection error codes guide lists every Microsoft and Gmail code with its own fix page.
Need this fixed today?
If you run a service business in Battle Creek, Kalamazoo, or anywhere in Southwest Michigan and would rather have this handled than do it yourself, the Parallax DMARC audit service covers the full setup: SPF, DKIM, DMARC, testing, and a follow-up report confirming enforcement is working. The same fix that stops the bounce also closes the spoofing window, meaning no one can send email that appears to come from your domain. Reach out at (269) 460-1772 or through the contact form.
If customers say your emails never arrive at all, why customers aren't getting your emails covers the other causes.
Frequently asked questions
How long does it take to fix the 550 5.7.515 error?
DNS changes take 24 to 48 hours to propagate fully. If you complete all five steps in one afternoon, most recipients will see successful delivery by the following business day. The actual configuration work usually takes under an hour for a single email provider.
Can I fix this myself without an IT person?
Yes, if you have login access to your domain registrar and your email provider's admin console. Google Workspace and Microsoft 365 both have step-by-step DKIM setup guides inside their admin interfaces. SPF and DMARC are standard DNS TXT records your registrar lets you add through a web form.
Does Gmail enforce the same rules as Microsoft?
The 550 5.7.515 code is specific to Microsoft (Outlook, Hotmail, Exchange Online). Gmail has its own rules: every sender needs SPF or DKIM, and senders of 5,000 or more messages a day also need DMARC. Mail that fails can be marked as spam or rejected. The fix is the same for both: SPF, DKIM, and DMARC aligned and published.
If I use Microsoft 365 already, am I protected?
Not automatically. Microsoft 365 gives you the tools to configure SPF and DKIM, but unless Microsoft manages your DNS, it does not add DNS records on your behalf. You need to add SPF at your registrar and enable DKIM through the M365 admin center. Many businesses on M365 for years still have neither configured.