Microsoft 550 5.7.509: “sending domain does not pass DMARC verification”

Short answer: Microsoft rejected the message because it failed DMARC and your domain publishes p=reject: neither SPF nor DKIM passed for the domain in your From address. Fix: make the sending service DKIM-sign with your domain (or add it to SPF), then check the result in the message headers.

Coming: DMARCbis (RFC 9989): pct Is Gone, t=, np= and psd= Are New — Update Your DMARC Record

The bounce looks like this
550 5.7.509 Access denied, sending domain [YOURDOMAIN.COM] does not pass DMARC verification and has a DMARC policy of reject.

What it means

Microsoft 365 and Outlook.com honour the sender's DMARC policy: when a message fails DMARC and the From domain says p=reject, it is rejected (with p=quarantine it goes to junk instead). DMARC passes only when SPF or DKIM passes and the passing domain matches the From address. The fix is always on the sending side; the recipient can't repair your DNS.

How to fix it

  1. Check the From domain with the checker below and look at DKIM first: most failures come from a tool (newsletter, CRM, helpdesk, website form) that signs with its own domain instead of yours.
  2. In that tool, turn on domain authentication / custom DKIM so it signs as your domain (see the setup guides). Adding its SPF include helps only if it also uses your domain as the return path.
  3. Can't get a tool aligned? Send its mail from a subdomain (for example news.yourdomain.com), set up SPF and DKIM there, and keep relaxed alignment (adkim=r; aspf=r) in your DMARC record.
  4. Forwarding breaks SPF: if the bounce follows a forward, DKIM is what has to survive. Check that the original message was DKIM-signed with your domain.
  5. Need mail flowing while you fix it? Switching DMARC to p=quarantine or p=none for a few days stops the rejections, but it also lets spoofed mail through. Move back once every sender passes.
  6. Confirm the fix in Outlook: open a test message, view the message source and check Authentication-Results for dmarc=pass.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Other bounce errors