Microsoft 365 550 5.7.64: “TenantAttribution; Relay Access Denied”

Short answer: Microsoft 365 couldn't match the server or printer that sent the message to your organization, so it refused to relay it outside. Fix: update your inbound (relay) connector with the device's current public IP or its renewed certificate, and make sure the sender's domain is verified in your tenant.

The bounce looks like this
550 5.7.64 TenantAttribution; Relay Access Denied SMTP.
4.4.62 Mail sent to the wrong Office 365 region
550 5.7.64 TenantAttribution; Relay Access Denied … ATT36

What it means

Your printer, scanner, app or on-premises mail server sends through your Microsoft 365 MX host (…mail.protection.outlook.com) without a login and relies on an inbound connector to prove the mail is yours. Exchange Online looked for a connector that matches the sender's TLS certificate or public IP, found none, and won't relay the message to outside recipients. Microsoft names the usual causes: the office's static IP changed (new ISP, new router, failover line), or the certificate was renewed or replaced with a different name. 4.4.62 is the same problem reported as a deferral. An ATT36 variant means the domain in the certificate or the sender address isn't a verified domain in your tenant.

How to fix it

  1. Find the public IP the device really sends from: on the same network open a site such as ifconfig.me, or read the connecting IP from the message trace in the Exchange admin center.
  2. Exchange admin center → Mail flow → Connectors → open the connector from Your organization's email server to Office 365. If it trusts an IP, replace the old address with the new one. If it trusts a certificate, set the domain to the name in the new certificate (Subject or SAN, e.g. *.contoso.com). Save and allow some time to apply.
  3. Hybrid Exchange after a certificate renewal: re-run the Hybrid Configuration Wizard and pick the new certificate on the transport certificate page (Microsoft's recommended fix); the send connector log shows which certificate is presented.
  4. ATT36: add and verify the domain from the certificate or the From address under Settings → Domains in the Microsoft 365 admin center.
  5. No connector at all yet? Follow the relay connector set-up: MX host, port 25, TLS, no login.
  6. Put the new IP in your SPF record (one record: v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all, built with the SPF generator) so relayed mail doesn't land in Junk.
  7. Static IP keeps changing, or the device is in Azure or another cloud? Relay isn't supported there. Use OAuth (smtp.office365.com, port 587) or an email sending service with its own login instead.

Step-by-step for your device or app

Not sure which devices still log in with a password? Run the free read-only script that lists every SMTP AUTH sender in your tenant.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other bounce errors