What 550 5.7.509 means
The message Microsoft attaches to this code is “Access denied, sending domain [$SenderDomain] does not pass DMARC verification and has a DMARC policy of reject.”, as written on its reference page. The first digit says how final it is: a 5xx reply is permanent for that message, so the sending server gives up and returns a bounce. The enhanced status 5.7.509 says what class of problem it is: authentication. The receiver could not authenticate the message: SPF, DKIM or DMARC failed or is missing. A DNS fix, not a reputation fix.
Why it happens
The receiving server checked who sent the message and could not make the answer add up. Either the sending service is not listed in the domain's SPF record, the DKIM signature is missing or does not verify, or the domain that passed authentication is not the domain in the From header, which is what alignment means. Nothing about volume or reputation changes this: the record is either right or it is not.
What to do first: DMARC fail at Microsoft. Align SPF/DKIM with the From domain.
Why warming does not fix this
Warming builds sender reputation. 550 5.7.509 in this form is a authentication problem, and no amount of engagement history changes it. Fix the cause and the bounce stops; warming is for what comes after, when the mail is accepted and the question becomes which folder it lands in. See how warming works for that part.
How to fix it, in order
- Run the auth checker on the sending domain
- Publish or repair the failing record (SPF, DKIM or DMARC)
- Check alignment with a message's headers in the auth checker
Related codes
- 550 5.7.23 (Microsoft): SPF violation
- 550 5.7.27 (Gmail): SPF authentication failed
- 550 5.7.30 (Gmail): DKIM authentication failed
- 550 5.7.40 (Gmail): no DMARC record or policy
- 421 4.7.32 (Gmail): From header not aligned
More on Microsoft 365
- Microsoft 365 emails going to junk: the trace in order: headers, Message Trace, quarantine, SNDS
- Microsoft bulk sender requirements: the 5 May 2025 authentication rules and the 550 5.7.515 rejection
- Microsoft 365 sending limits: the documented recipient and message rate limits
Questions about 550 5.7.509
What does 550 5.7.509 mean?
Microsoft returns 550 5.7.509 with the message "Access denied, sending domain [$SenderDomain] does not pass DMARC verification and has a DMARC policy of reject.": DMARC verification failed. The receiver could not authenticate the message: SPF, DKIM or DMARC failed or is missing. A DNS fix, not a reputation fix.
Is 550 5.7.509 a hard bounce or a soft bounce?
A hard bounce for that message: the 550 reply is permanent, and the message is not retried. Whether the address should be removed depends on the cause: here the fix is on the sending side, not the list.
How do I fix 550 5.7.509?
DMARC fail at Microsoft. Align SPF/DKIM with the From domain. Microsoft's own reference for the code is linked on this page.
Does email warmup fix 550 5.7.509?
No. 550 5.7.509 in this form is a authentication problem, and warming builds reputation, which is not what is failing here. Fix the cause and the bounce stops.