Email Bounced With 550 5.7.509? Your DMARC Works, One Tool Doesn't

The fix for 550 5.7.509 is to find the service that sent the failed message and make it sign or send as your domain. Your domain's DMARC record says "reject," and this message failed both aligned checks, so Microsoft did exactly what your record asked. Don't delete the record. Fix the sender that isn't lined up, then resend.

What does 550 5.7.509 mean?

The 550 5.7.509 code means Microsoft 365 rejected a message because the sending domain failed DMARC and publishes a reject policy. Microsoft's NDR reference gives the text as "Access denied, sending domain [$SenderDomain] does not pass DMARC verification and has a DMARC policy of reject." It also says the cause is that the domain in the visible From address "doesn't pass DMARC." The 550 marks it as permanent. Nothing retries.

Some DMARC rejections show 550 5.7.1 instead. Microsoft's DMARC setup guide lists inbound mail that fails a reject policy as "Rejected during SMTP (550 5.7.1)" when the recipient honors DMARC. If the text mentions DMARC or the headers show action=oreject, the fix is the same.

What does a 550 5.7.509 bounce mean for my business?

A 550 5.7.509 bounce means one of your tools can't reach customers on Microsoft 365, and every message it sends is lost until it's fixed. The good news: your domain is set to reject forgeries, which most local businesses haven't done. A Parallax Intelligence check found 79.2% of 847 businesses that email from their own domain (1,527 checked) in Southwest Michigan have no DMARC enforcement. You're ahead. You just have one sender that didn't get set up.

Why does a message fail DMARC when SPF passes?

A message fails DMARC when neither SPF nor DKIM passes for a domain that matches the From address. Passing is not enough. The passing domain has to line up with yours. Microsoft's DMARC guide says "A message passes DMARC if one or both of the described SPF or DKIM checks pass. A message fails DMARC if both of the described SPF and DKIM checks fail," where each check includes alignment.

The usual culprit is a tool that sends as you from its own servers. Microsoft's guide lists it first among common failures: a non-Microsoft service where "SPF passes" for the service's domain "but DMARC fails," because the service uses its own domain for the envelope and does no DKIM signing with yours. Invoicing apps, CRMs, booking tools and website forms all fit that pattern. Forwarding is the other common cause, since it can break SPF on the way through.

How do I fix 550 5.7.509 step by step?

You fix 550 5.7.509 by finding the sender that failed and giving it an aligned SPF or DKIM pass. Here's the order, based on Microsoft's DMARC troubleshooting steps:

1. Find the sender. Open the headers of a failed copy, or the bounce, and look at the Authentication-Results line. Microsoft's guide shows the reject case as dmarc=fail action=oreject.
2. Compare the domains. Check smtp.mailfrom= and header.d= against header.from=. If neither matches your domain, that's the problem.
3. Turn on DKIM with your domain. In the sending tool, find "authenticate your domain" or "custom DKIM" and publish the records it gives you. This is the fix Microsoft recommends when you can't change the envelope domain.
4. Or change the envelope domain. Some tools let you set a custom bounce or return-path domain on your domain. That fixes SPF alignment.
5. Use a subdomain for bulk mail. Microsoft suggests a subdomain such as marketing.yourdomain.com for services you don't control, with its own SPF, DKIM and DMARC.
6. Resend and watch reports. Resend the bounced mail, then read your DMARC aggregate reports for a few weeks to catch any sender you missed.

To check a bounce before you start, paste it into the free reader on the 550 5.7.509 page at postmortem.report. It runs in your browser and names the error. Got a different code? The email rejection error codes guide lists every code with its own fix page.

Should I switch DMARC to p=none to stop the bounces?

Only for a short window, and only while you fix the failing sender. Dropping to p=none stops the rejections, but it also stops protecting your domain from spoofing. Microsoft's rollout advice runs the other way: start at none, move to quarantine, then reject once reports are clean. If one key tool is bouncing today, step back for a few days, fix its alignment, then return to reject. The DMARC setup guide for Microsoft 365 walks through each stage.

When should you get help with a DMARC reject bounce?

You should get help when you can't tell which service sent the failed mail, or when the fix needs DKIM set up across several tools. If you run a business in Battle Creek, Kalamazoo or anywhere in Southwest Michigan and want it handled, the Parallax DMARC audit service finds every tool that sends as you, aligns SPF and DKIM for each one, and keeps your reject policy in place. Call (269) 460-1772 or use the contact form and tell me what the bounce says.