Microsoft 550 5.7.520: “Your organization does not allow external forwarding” / AS(4810)

Short answer: Usually your Microsoft 365 organisation blocks automatic forwarding to outside addresses, so a forwarding rule bounced. Fix: an admin sets Automatic forwarding rules to On in an outbound spam policy for those users. With AS(4810), Outlook.com has restricted your account from sending.

The bounce looks like this
550 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)
550 5.7.520 Message blocked because it contains content identified as spam. AS(4810)

What it means

Two different errors share this code. AS(7555) is the common one, in Microsoft 365: a mailbox tried to forward mail automatically to an outside address – through an Inbox rule or forwarding set by an admin – and the outbound spam policy blocks external forwarding. Since 2021 the default setting, Automatic - System-controlled, means “off” unless your organisation was already relying on it, because attackers use forwarding rules to siphon off mail. Forwarding between colleagues is not affected. AS(4810) shows up on personal Outlook.com and Hotmail accounts that Microsoft's outbound filter has restricted from sending. Microsoft publishes no page for it, and only Outlook.com support can lift it.

How to fix it

  1. AS(7555), admins: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam. Create an outbound policy for just the users who need forwarding (or edit Anti-spam outbound policy (Default)) and set Automatic forwarding rules to On - Forwarding is enabled.
  2. Prefer a policy for named users over switching forwarding on for everyone: forwarding to outside addresses is a classic sign of a hacked mailbox.
  3. Still bounced? A block elsewhere wins. Check Remote domains (automatic forwarding allowed for that domain) and any mail flow rule that blocks auto-forwarded messages in the Exchange admin center.
  4. Nobody set up forwarding? Treat it as a compromise: check the user's Inbox rules and mailbox forwarding, reset the password and turn on MFA. Exchange admin center → Reports → Mail flow → Auto forwarded messages report shows who forwards where.
  5. AS(4810), personal Outlook.com or Hotmail: there is no setting to change. Check the account for signs of a hack (mail you didn't send, unknown rules or sign-ins) and secure it, then contact Microsoft support – from another account if you can't sign in – and ask for a review of the outbound sending restriction. Keep the account's phone number and alternate email up to date.
  6. If that account sends business mail, move it to your own domain on a business mailbox with SPF, DKIM and DMARC (check it below). Personal accounts have fixed sending limits and no admin who can lift a block.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Other bounce errors