550 5.7.515: what Microsoft's bounce means and how to fix it

550 5.7.515 is a Microsoft rejection. It means mail sent to Outlook.com, Hotmail or Live was refused because your sending domain does not meet the email-authentication level Microsoft now requires from high-volume senders. The full bounce reads:

550 5.7.515 Access denied, sending domain [your-domain] does not meet the required authentication level.

To pass, your domain needs three things working together: SPF and DKIM must both authenticate, a DMARC record must be published, and at least one of SPF or DKIM must align with the domain in your From address. Miss or misconfigure any one of them, and Microsoft rejects the message outright rather than filtering it to junk.

What the 550 5.7.515 bounce means

Microsoft enforces stricter authentication for high-volume senders — domains sending roughly 5,000 or more messages in a day to its consumer mailboxes (Outlook.com, Hotmail.com, Live.com) from the same From domain. Below that threshold the rule is not enforced today — but the same records keep you out of the junk folder, so do the fix anyway.

The rejection is not a content or reputation problem you can talk your way out of — it is a hard authentication gate. Microsoft requires all of the following for the domain in your 5322.From address:

• SPF passes — the sending server is authorized by your SPF record, which must resolve within the 10-lookup limit.
• DKIM passes — the message carries a valid DKIM signature for your domain.
• DMARC is published — a DMARC record exists for the domain, at minimum v=DMARC1; p=none.
• DMARC alignment — SPF or DKIM (at least one) aligns with your From-address domain.

How to fix it

Work the checks in order — each one links the tool that verifies it:

1. Fix SPF first. Confirm your SPF record authorizes every service that sends as your domain and stays within the 10-lookup limit — an over-limit SPF record fails outright and takes DMARC alignment down with it. Paste your record or domain into the SPF lookup counter to see the count and the offending mechanism.
2. Enable DKIM signing. Turn on DKIM in your email platform (Google Workspace, Microsoft 365, your ESP) so outgoing mail is signed with a selector under your domain, not the provider's. This is what gives you an aligned pass even when SPF is relaxed.
3. Publish DMARC and confirm alignment. Add a DMARC record — v=DMARC1; p=none is enough to clear the gate — then verify that SPF or DKIM aligns with your From domain. Paste your record into the DMARC record checker to validate the tags and preview a safe policy upgrade.

After the DNS changes propagate, re-send. If a step still fails, the fastest way to see all three at once — SPF count, DKIM presence, and DMARC alignment — is a full scan.

Common questions

Is 550 5.7.515 about my reputation or my authentication? Authentication. It is a hard gate on SPF, DKIM and DMARC, not a spam-score decision — no amount of warm-up fixes it until the records pass and align.

Do I have to reach p=reject? No. Microsoft's gate is cleared by a published DMARC record with SPF or DKIM alignment; p=none satisfies it. Moving to quarantine or reject protects you from spoofing, but only do so once a full scan confirms every legitimate source is aligned.

I send far fewer than 5,000 a day — why did I get this? The threshold is a rolling count and Microsoft applies it per sending domain; shared or third-party platforms can push you over it. The same SPF/DKIM/DMARC fix resolves it regardless of your own volume.