The fix for 550 5.7.1 depends on the words right after the code. "Unable to relay" means a device or app is sending through a server that won't carry its mail, so it needs to sign in or use a connector. "Delivery not authorized" means the recipient blocks you, so they have to allow you. "Blocklist" means your IP is listed, so you request removal. Read the line, then pick the fix.
What does 550 5.7.1 mean?
The 550 5.7.1 code means a security or policy setting stopped your message. It's a catch-all, not one specific failure. Microsoft's fix page for 5.7.1 in Exchange Online says the error "indicates a security setting in your organization or the recipient's organization is preventing your message from reaching the recipient," and that its advice also covers codes 5.7.0 through 5.7.999. The 550 at the front makes it permanent.
Gmail uses the same code for a long list of its own reasons. Google's Gmail SMTP error reference lists 550 5.7.1 for spam, low sender reputation, missing or broken From headers, and messages that are "not RFC 5322 compliant." So the text after the code is what tells you what happened.
What does a 550 5.7.1 bounce mean for my business?
A 550 5.7.1 bounce means a customer didn't get your message, and the same thing will keep happening until the cause is fixed. For a small office the usual story is one device, like a scanner that stopped emailing PDFs, or one customer whose system only accepts approved senders. The fix is usually small once you know which version you have.
What does 550 5.7.1 unable to relay mean?
"550 5.7.1 Unable to relay" means the server you handed the message to won't pass it on, because it doesn't trust the sender. Microsoft's NDR reference for Exchange Online lists three common causes: spam using the server, "An MX record for a domain points to a receiving email system where that domain isn't accepted," and a sending system or device that "doesn't have the correct permissions" to relay.
The third one is the usual story for a small office. A scanner, a line-of-business app or a website plugin sends mail through Microsoft 365 without signing in, or from an IP address that has no connector. The fix is to give that device a real way in: sign in with a licensed mailbox over authenticated SMTP, or have your admin set up a connector for your office's fixed IP address. A related variant, "Client was not authenticated," has the same fix. Microsoft's note on it says "The sending email system administrator must configure the sending email system to authenticate."
What does 550 5.7.1 delivery not authorized mean?
"Delivery not authorized" means the recipient's system is set to refuse mail from you. Microsoft says it "frequently occurs when a sender tries to send messages to a distribution group that's configured to accept messages only from members." It can also come from a mail flow rule. You can't fix this one from your side. Call or text the recipient and ask their email admin to allow you, or to let the group take outside mail.
How do I fix 550 5.7.1 step by step?
You fix 550 5.7.1 by matching the bounce text to its cause and fixing that one thing. In order:
- Copy the full bounce. You need the "Diagnostic information for administrators" section, not only the first line.
- Match the phrase. Unable to relay or not authenticated: fix the sending device. Delivery not authorized: contact the recipient. Blocklist: request removal.
- Blocklist removal. If the bounce says "blocked using Blocklist 1," Microsoft's fix page says to "forward the NDR message to [email protected]." For codes 5.7.606 to 5.7.649, a banned sending IP, Microsoft's NDR reference points to its self-service delist portal instead.
- Check your own domain. Microsoft says to confirm your domain shows as Healthy under Settings, Domains in the Microsoft 365 admin center, and that you have only one MX record.
- Check SPF. Microsoft also lists an incomplete SPF record as a cause. Run your domain through the free email security check to see whether every sender is covered.
- Resend. Send one test to the same recipient before resending everything.
To check which variant you have, paste the bounce into the free reader on the 550 5.7.1 unable to relay page at postmortem.report. It runs in your browser and names the error. Got a different code? The email rejection error codes guide lists every code with its own fix page.
When should you get help with a 5.7.1 bounce?
You should get help when the bounce comes from your own Microsoft 365 tenant and a device or app has to relay through it, or when SPF and DMARC are part of the cause. If you run a business in Battle Creek, Kalamazoo or anywhere in Southwest Michigan, the Parallax DMARC audit service maps every system that sends as your domain and sets up SPF, DKIM and DMARC across them. Call (269) 460-1772 or use the contact form and tell us what the bounce says.