Fixes / Outlook · Checked September 30, 2026

Outlook 554 5.7.1 message rejected: what it means and how to fix it

Short answer

554 5.7.1 means a mail server refused to accept your email because of a security or permission rule. Your message was not sent. If you use a non-Microsoft address in Outlook (IMAP or POP), the most likely fix is to turn on outgoing server (SMTP) authentication and use port 587 with STARTTLS or 465 with SSL. Otherwise, read the bounce text to see which server blocked you.

What this message means

5.7.x codes are permission and security refusals. A server between you and the recipient checked your message and refused it. The server can be your own provider's outgoing server, the recipient's server or a relay in between. The 554 (or 550) at the front means the refusal is permanent, so Outlook will not retry it and you have to change something first. The words after the code in the bounce tell you the reason. "Relay access denied" means your own outgoing server did not recognise you. "Blocked using", "banned sending IP" or "Blocklist" means your server's IP address is on a spam list. "You don't have permission to send to" means the recipient or group only accepts mail from approved senders.

Common causes

Cause	How to tell
Your outgoing (SMTP) server is not getting your username and password	The bounce says "Relay access denied". Every message to addresses outside your own domain bounces, but mail to colleagues on the same domain may still get through. This usually happens with IMAP or POP accounts from web hosts or internet providers.
The sending server's IP address is on a spam blocklist	The diagnostic text includes "blocked using", "Blocklist 1", "banned sending IP", "Client host [x.x.x.x] blocked" or a link to sender.office.com, spamhaus.org or similar. Mail to some providers (often Outlook.com, Hotmail or Microsoft 365 addresses) fails while mail to others arrives.
The recipient, or a group you are sending to, only accepts mail from approved senders	The bounce says you don't have permission to send to the recipient, names a distribution group, or mentions RESOLVER.RST.AuthRequired or "authentication required". Only that one address or group fails.
Your domain's SPF, DKIM or DMARC records are missing or wrong (custom domains)	The text mentions SPF, DKIM, DMARC, "sender not authorized" or "failed authentication". You send from your own domain (for example you@yourcompany.com), and bounces started after you changed email hosts or added a sending service like a newsletter tool.
Your organisation's mail flow rules or a misconfigured MX record or connector	Several people in your organisation get the same bounce. It often starts right after a Microsoft 365 migration, a DNS change or a hybrid Exchange setup.
The recipient address is mistyped or the recipient's server has a temporary problem	Only one address fails and there is a spelling mistake in it. Or it failed once, and the same message to the same address goes through a few hours later.

How to fix it

1. Read the bounce message to find which server refused you

Open the undeliverable message in your Inbox.
Find the "Diagnostic information for administrators" section (in some providers' bounces it is simply the text under the error code).
Look for the server name after "Remote Server returned" or "Generating server". If it is your provider's server (for example smtp.yourhost.com), the problem is on your side. If it belongs to the recipient's domain, the recipient's side refused the message.
Match the words after 554 5.7.1 ("Relay access denied", "blocked using", "permission", "SPF") to the causes above, then go to the matching fix below.

2. Turn on SMTP authentication and use the correct port

Classic Outlook for Windows (Microsoft 365, 2021, 2019, 2016) with IMAP or POP accounts. Outlook for Mac: Outlook > Settings > Accounts, select the account, then under Outgoing server choose More Options and set Authentication to Use Incoming Server Info.

Go to File > Account Settings > Account Settings.
Select the email account and click Change.
Click More Settings, then open the Outgoing Server tab.
Tick "My outgoing server (SMTP) requires authentication" and select "Use same settings as my incoming mail server".
Open the Advanced tab. Set Outgoing server (SMTP) to 587 with encryption TLS (or STARTTLS), or to 465 with SSL/TLS, matching what your email provider documents.
Click OK, Next, then Finish, and send a test message to an outside address such as a Gmail account.

3. Re-add the account in new Outlook for Windows

New Outlook for Windows, which has no Outgoing Server tab

Go to Settings (gear icon) > Accounts > Email accounts.
Next to the failing account, choose Manage, then Remove.
Choose Add account, enter your email address and pick IMAP or POP when asked, then open the advanced settings.
Enter the SMTP server, port (587 or 465), encryption and your full email address and password exactly as your provider lists them.
Send a test message to an outside address.

4. Get the sending IP removed from the blocklist

Copy the IP address shown in square brackets in the bounce.
If your mail is hosted by a provider (web host, ISP, Google, Microsoft 365), send them the full bounce. It is their IP, and only they can fix what caused the listing.
If the bounce says "banned sending IP" and mentions sender.office.com, the server's owner can request removal at https://sender.office.com using the IP from the bounce and a mailbox they can check for the confirmation link.
If the bounce mentions 5.7.511 or says to forward the message to delist@microsoft.com, forward the full bounce there instead. The delist portal does not work for that code.
Allow up to 24 hours after removal, then send again. For other lists (Spamhaus, Barracuda and so on), use the removal link in the bounce.

5. Ask for permission to send to a restricted recipient or group

Check the address in the To line for typos and fix them if needed.
If the bounce names a group in your organisation, find the owner. In classic Outlook, open the bounce, double-click the group name and choose Contact. In Outlook on the web, select the group name and choose Owner.
Ask the owner to add you to the allowed senders, or to allow external senders if you are outside the organisation.
Groups with more than 5,000 members need moderator approval. Ask the moderator to approve your message, or join the group.
For an external recipient, contact them another way (phone, another email address) and ask them to have their email admin accept mail from your address.

6. Fix SPF, MX and connector settings (email admins)

Admins of custom domains, especially on Microsoft 365 / Exchange Online

In the Microsoft 365 admin center, go to Settings > Domains and confirm your domain shows as Healthy.
Check that your SPF TXT record includes every service that sends as your domain (for Microsoft 365, include:spf.protection.outlook.com) and that there is only one SPF record.
Confirm there is exactly one MX record, pointing to yourdomain.mail.protection.outlook.com (or the .mx.microsoft form).
Run the Inbound and Outbound SMTP Email tests at https://testconnectivity.microsoft.com.
For hybrid setups, check Exchange admin center > Mail flow > Connectors, and rerun the Hybrid Configuration Wizard if the connectors are wrong.

Next time, skip the search

Crade is an AI assistant for Mac and Windows that sees your screen. When a message like this pops up, ask “what does this mean?” and it explains the exact error in front of you, step by step.

Download Crade

Still not fixed?

Forward the complete bounce message, including the "Diagnostic information for administrators" section, to whoever runs your email: your IT department, your web host or your internet provider. That text names the exact server and rule that refused the message, so they can fix it much faster. If the recipient's server refused you, contact the recipient another way and ask them to pass the bounce to their email admin. You cannot change their server's rules from your end. If a message to one address bounced once, wait a few hours and try again, because recipient-side problems sometimes clear up without any changes.

Questions people ask

Did my email get sent?

No. A 554 5.7.1 bounce means the message was refused permanently and nobody received it. You need to fix the cause and send it again.

Is it my fault or the recipient's?

Look at the bounce. "Relay access denied" or a server name from your own provider points to your settings. "You don't have permission to send to" or a server from the recipient's domain points to their side, and only their admin can change it.

Why can I send to some people but not others?

Either the recipient's server is enforcing a rule (a blocklist, restricted group or SPF check) that other servers don't, or your outgoing server only lets you send to addresses in your own domain without authentication. Turning on SMTP authentication fixes the second case.

What's the difference between 550 5.7.1 and 554 5.7.1?

Both are permanent refusals for a security or policy reason. The 550 or 554 prefix depends on which server sent the bounce, and the fixes are the same.

How long does it take to get off a Microsoft blocklist?

After you confirm a request at sender.office.com, removal can take up to 24 hours or longer. For 5.7.511 bounces sent to delist@microsoft.com, Microsoft says it replies within 48 hours.

Sources

Related errors