Is 550 5.7.509 permanent or temporary?

550 5.7.509 is a permanent (5.x.x) failure — the server will not accept the message as-is, and retrying without changing anything won't help. You need to fix the underlying cause.

Is this my problem or the recipient's?

It depends on the cause — a real sending service is not authenticated is the most common. Work through the causes below to find which applies to you.

How do I check my sending setup?

Run a free EmailHealth check on your domain — it verifies SPF, DKIM, DMARC, blacklist status, and more in a couple of seconds, which covers the most common causes of delivery failures.

550 5.7.509 — Microsoft: sending domain fails DMARC with p=reject

550 5.7.509 is a permanent SMTP reply meaning microsoft: sending domain fails dmarc with p=reject. Your domain publishes p=reject, and this message passed neither aligned SPF nor aligned DKIM. So the receiver rejected it.

What 550 5.7.509 means

Your domain publishes p=reject, and this message passed neither aligned SPF nor aligned DKIM. So the receiver rejected it.

⚠️

This is a 5.x.x permanent failure — the message will keep bouncing until you fix the cause. Retrying the same message unchanged won't help.

Common causes

📨

A real sending service is not authenticated

Most common

A CRM, helpdesk, billing or cold-email tool sends as your domain without DKIM or SPF for your domain.

🔁

Forwarding or a mailing list broke authentication

Common

The message was forwarded or changed by a list, which broke SPF and DKIM.

⚙️

Someone is spoofing your domain

Common

If the message was not from you, the rejection is DMARC working as planned.

How to fix 550 5.7.509

1
Find the source in DMARC reports
Aggregate reports (rua) show every IP that sends as your domain and whether it passes. Upload one to the free DMARC report parser.
2
Authenticate each real sender
Set up DKIM with your domain for each service and add it to SPF.
3
Lower the policy only for a short time
If real mail is blocked now, you can change p=reject to p=quarantine while you fix the senders, then change it back.

Confirm your domain is set up correctly

Most delivery failures — permanent or temporary — trace back to authentication or reputation. Run a free EmailHealth check to confirm SPF, DKIM, DMARC, blacklist status, and TLS are all healthy for your sending domain. If you send in volume, free daily monitoring will alert you before a small issue becomes a flood of bounces.

Microsoft: sending domain fails DMARC with p=reject