Inbox check guide
Error 550 5.7.515 Access denied: what it means and how to fix it
Reviewed
Short answer
550 5.7.515 means Outlook.com refused your message because your sending domain doesn’t meet its authentication level: SPF must pass, DKIM must pass, and the domain must publish a DMARC record (at least p=none) that aligns with SPF or DKIM. Fix the one that fails — usually DKIM or a missing DMARC record — and the rejections stop.
Check your domain now
What the error says
The full bounce reads: “550; 5.7.515 Access denied, sending domain [your domain] does not meet the required authentication level.” It comes from Microsoft’s consumer mail service — outlook.com, hotmail.com and live.com addresses.
Microsoft introduced the requirement for domains sending more than 5,000 messages a day and chose to reject failing mail rather than send it to junk. If you see this bounce, at least one of the three checks failed for that message.
The three things Outlook checks
All three must hold for the domain in your From address:
- SPF passes: the server that sent the message is listed in your domain’s SPF record.
- DKIM passes: the message carries a valid signature for your domain.
- DMARC exists: your domain publishes a DMARC record of at least p=none, aligned with SPF or DKIM — preferably both.
How to fix it
Run the inbox check on your domain. It shows which of the three fails and gives the record to add for your email provider and DNS host.
If you send through a newsletter or invoicing service, set up its domain authentication too: the message must be signed with your domain, not the service’s, or DMARC alignment fails even when SPF and DKIM pass for the service.
After changing DNS, wait for it to apply (usually within an hour, up to 48), then send a test to an outlook.com address and look for “spf=pass”, “dkim=pass” and “dmarc=pass” in the message’s Authentication-Results header.