Mail errors · Microsoft 365 and Outlook

What does “5.7.509 Access denied, sending domain [$SenderDomain] does not pass DMARC verification and has a DMARC policy of reject.” mean?

Microsoft refused the message because it failed DMARC and your domain's policy is p=reject.

Last read from the sources at the foot of this page.

Check my firm Read the steps
Microsoft bounce
Microsoft Outlook
5.7.509

Access denied, sending domain [$SenderDomain] does not pass DMARC verification and has a DMARC policy of reject.

As Microsoft prints it.
01

What does it mean?

The From address used your domain, neither SPF nor DKIM passed for it, and your record asks for such mail to be refused.

02

What exactly does the source say?

5.7.509 Access denied, sending domain [$SenderDomain] does not pass DMARC verification and has a DMARC policy of reject. The sender's domain in the 5322.From address doesn't pass DMARC.

03

Why would a small firm see it?

A service that sends in your name was not added to SPF and does not sign with DKIM for your domain, or the message was forwarded. If nobody at your firm sent it, the policy stopped a forgery.

04

How do I fix it?

  1. Read the bounce and your DMARC reports to find the sending service.
  2. Turn on DKIM signing for your domain at that service.

Keep one SPF record. Add the service inside the one record you have, before its last word, and keep every service already in it. A second SPF record makes the check fail for every message.

An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10 the check fails, so take out services you no longer use before adding a new one.

05

What else do the sources say?

Missing or incorrect DMARC/DNS records: Alignment issues, missing SPF, and policy issues Missing DKIM or DKIM records: Missing DKIM DNS record (public key) or the message isn't DKIM-signed at the time of sending (private key) Forwarding emails: Message forwarding that breaks SPF or DKIM

Sources

Where does this come from?

Related
07 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy