550 5.7.64 is a permanent SMTP reply meaning tenantattribution; relay access denied (exchange online). Microsoft explains that something changed in your on-premises environment, so the inbound connector's configuration no longer matches and Exchange Online cannot tell which tenant the mail belongs to.
What 550 5.7.64 means
Microsoft explains that something changed in your on-premises environment, so the inbound connector's configuration no longer matches and Exchange Online cannot tell which tenant the mail belongs to.
Common causes
The on-premises public IP changed
Most commonThe connector is set to accept mail from a specific IP, and the server now sends from another one.
The certificate the connector expects changed
CommonThe connector identifies your server by certificate name, and the certificate was renewed with a different name.
The connector was edited or removed
Less commonA change in the Exchange admin center broke the match.
How to fix 550 5.7.64
- 1
Compare the connector with the real server
In the Exchange admin center, check the inbound connector's sender IPs or certificate name against what your server uses now.
- 2
Update and validate the connector
Correct the IP or certificate setting and use the connector validation in the admin center.
- 3
Check SPF at the same time
If the public IP changed, your SPF record may also need the new address.
Confirm your domain is set up correctly
Most delivery failures — permanent or temporary — trace back to authentication or reputation. Run a free EmailHealth check to confirm SPF, DKIM, DMARC, blacklist status, and TLS are all healthy for your sending domain. If you send in volume, free daily monitoring will alert you before a small issue becomes a flood of bounces.