TL;DR:
To fix SMTP Error 550 5.7.1 in Exchange Online, administrators must evaluate the full non-delivery report (NDR) to identify the rejecting system and run an Exchange admin center message trace before modifying any mail flow settings.
● For "Unable to relay" rejections originating from applications or devices, verify the specific Exchange SMTP relay connector's trusted source IP or certificate identity rather than creating an unrestricted internet-wide relay.
● For "Delivery not authorized" rejections, the recipient administrator must resolve the restriction by adjusting distribution group memberships, moderation permissions, or allowed-sender lists instead of disabling global anti-spam filtering.
● Applications utilizing SMTP AUTH client submission on smtp.office365.com via port 587 must transition to OAuth-capable methods before Microsoft disables Basic Authentication by default for existing tenants at the end of December 2026.
Ask AI for a summary
ChatGPT
Perplexity
Gemini
Claude
Grok
SMTP error 550 5.7.1 generally means that a mail server permanently refused a message because of a policy, permission, or routing restriction. It does not automatically mean that the mailbox database is corrupt. In Microsoft Exchange Online, the fastest way to investigate is to read the entire non-delivery report (NDR), identify which server rejected the message, and then check the related mail flow in the Exchange admin center.
If you are the sender, preserve the returned error text and contact the recipient's administrator when the rejection is on their side. If you administer the sending organization, use the steps below to distinguish recipient restrictions from an incorrect Exchange SMTP relay or SMTP AUTH configuration. Microsoft's Exchange Online 5.7.1 guidance explains why these causes need different fixes.
In This Article
Part 1. What Does SMTP 550 5.7.1 Mean?
The three-digit SMTP reply 550 denotes a permanent failure, so an unchanged message normally will not be accepted on another automatic delivery attempt. The enhanced status code 5.7.1 indicates a delivery restriction, frequently associated with policy or permission. The actual NDR diagnostic text is essential: Unable to relay, Delivery not authorized, Command rejected, and other variations can originate from different systems.
In Exchange Online, Microsoft lists restricted recipients, distribution-group permissions, missing relay authorization, and routing to the wrong server among possible causes. An SMTP rejection does not prove a deleted email, lost attachment, or damaged Exchange EDB database. Treat this as a mail-flow problem first.
| NDR symptom | Check first | Who can act? |
| 550 5.7.1 Unable to relay / Relaying denied | Sending route, accepted domain, SMTP relay connector, source identity | Sending or receiving mail administrator |
| 550 5.7.1 Delivery not authorized | Group membership, allowed-sender list, external sender restrictions, transport rules | Recipient owner or mail administrator |
| 550 5.7.1 Command rejected | Full server diagnostic and recipient domain's rejection policy | Administrator of the rejecting system |
| 550 5.7.25 | IP identity, reverse DNS, and sender verification, as described in the specific NDR | Sending mail administrator |
Save the full bounce report, including the rejected recipient, timestamp, sending IP or host when available, and any extended diagnostic such as 550 5.7.1_etr. Do not infer the precise cause from a search query containing only the numeric code. Microsoft's NDR error reference explains how enhanced status variants differ.
Part 2. Identify the Rejection Before Changing Settings
Begin with a non-destructive investigation. It will tell you whether Exchange Online received the message and what happened before it was rejected or deferred.
Read the NDR and run an Exchange Online message trace
When to use: You have a bounced email from an Exchange Online organization and administrator access to the appropriate tenant. The expected result is a trace that confirms message handling, not an immediate change to mail routing.
Step 1. Open the complete NDR and note the exact enhanced code, rejecting server, sender, recipient, and failure time. In the Microsoft Exchange message trace instructions, administrators open the Exchange admin center and go to Mail flow > Message trace.
Step 2. Select Start a trace. Enter the sender and recipient where appropriate, choose a time range that contains the failed message, and run the trace. A trace can distinguish received, rejected, deferred, and delivered states.
Step 3. Compare the trace to the NDR. If the message is not visible, confirm you selected the correct tenant, time range, and accounts; messages rejected before reaching your tenant may need investigation by the sending or recipient provider. If the trace shows a rejection, investigate its detailed status instead of changing unrelated security settings.
Check: After the administrator makes an approved, narrowly scoped correction, send one test message to the affected recipient and verify delivery with a new trace. Do not interpret an NDR's permanent-failure status as proof that retrying will repair a persistent policy restriction.
Part 3. Fix Exchange SMTP Relaying Denied
Once you identify the rejecting system, check who is allowed to receive the message and whether the outgoing system is authorized to use the selected Exchange SMTP path.
Check recipient permissions and delivery restrictions
When to use: The NDR reports Delivery not authorized, a restricted distribution group, or another recipient-policy restriction. The recipient's owner or administrator usually needs to make the correction.
Step 1. Confirm the recipient address from the NDR. If it is a distribution group, ask its owner whether membership, moderation, or an allowed-senders list is rejecting the sender. If the sender is outside the organization, confirm whether the group is allowed to accept external mail.
Step 2. The recipient administrator should review the affected recipient's delivery management settings and relevant mail flow rules. Change only the rule or sender permission responsible for the rejection; do not disable anti-spam filtering globally to make one message pass.
Step 3. Test delivery to this recipient and to one unaffected recipient. If only the original address remains blocked, keep investigating that recipient's policy rather than rewriting your entire Exchange server SMTP configuration.
Microsoft's restricted-recipient troubleshooting steps distinguish sender and recipient responsibilities. For this branch, the related message trace screen above helps the administrator confirm the attempted recipient and event state.
Verify Exchange Online SMTP relay connectors
When to use: The NDR says Unable to relay and the message originated from a device, application, on-premises Exchange Server, or third-party mail system that sends through Exchange Online. This is a mail-administrator task, not a general fix for every 550 error.
Step 1. Identify whether the application is using authenticated client submission, connector-based SMTP relay, or Direct Send. These are distinct Microsoft 365 sending methods. Do not replace an SMTP AUTH host with an MX endpoint without configuring the correct sending path.
Step 2. Open the Exchange admin center at Mail flow > Connectors and inspect the relevant existing connector. Only if one is genuinely needed should the administrator use Add a connector and select the appropriate sending direction.
Step 3. Check the actual connector's source IP or certificate identity, status, scope, and routing options against the on-premises server or application sending the mail. If you use a partner or hybrid connector, also verify the intended smart-host or MX destination and any required TLS configuration.
Step 4. Apply only the necessary correction after validating trusted source IPs, authorized domains, and expected recipient scope. Do not create an unrestricted relay or allow arbitrary clients to submit to external recipients. Retest the affected message path and inspect a new message trace.
Follow the current Microsoft Exchange Online connector guide and application and device SMTP setup comparison for requirements that fit your environment.
Image credit: Microsoft Exchange Online administration interface images are reproduced unmodified from Microsoft Learn. Used with permission from Microsoft. Microsoft does not sponsor or endorse this article.
Part 4. Check SMTP AUTH, Ports, and Similar Error Codes
Not every rejected message is a relay-connector problem. An old application might be using SMTP client authentication, or the recipient's mail provider might be applying its own security policy.
Choose the correct Exchange Online SMTP sending method
Use this comparison only after identifying where the message originates. It is a diagnostic reference, not instructions to open every port or change tenant-wide authentication defaults.
| Sending method | Typical host/port | Authorization and scope |
| SMTP AUTH client submission | smtp.office365.com, port 587, STARTTLS | Authenticated account; OAuth-supported flow. Confirm the account is authorized to submit. |
| Exchange Online SMTP relay | Your organization's Microsoft 365 MX endpoint, typically port 25 | Inbound connector verifies a trusted source using the configured static IP or certificate method. |
| Direct Send | Your organization's MX endpoint, typically port 25 | Unauthenticated to accepted domains in your tenant; not for internet-wide relay. |
SMTP AUTH setting to verify: An Exchange Online admin can check a mailbox's Authenticated SMTP setting in Microsoft 365 admin center > Users > Active users > Mail > Manage email apps. In Exchange Online PowerShell, the mailbox property SmtpClientAuthenticationDisabled controls the override: True means disabled, False means enabled, and a blank value defers to the organization setting. Do not broadly enable legacy authentication just to pass one delivery test. Read Microsoft's current SMTP AUTH controls before editing policy.
Important for 2026: Microsoft updated the SMTP AUTH Basic Authentication timetable. According to its January 2026 announcement, current behavior remains through December 2026; Basic Authentication is scheduled to be disabled by default for existing tenants at the end of that month, while the final removal date is to be announced in the second half of 2027. Plan migration to OAuth-capable methods instead of building a new password-only dependency. See Microsoft's updated SMTP AUTH timeline.
Interpret Gmail, Outlook, and other 5.7.x variants
550 5.7.1 in Gmail: Read the rejection's domain-specific details. Gmail and Microsoft Exchange Online operate different receiving systems, and an error containing the same enhanced status may point to different sender-authentication or anti-abuse rules. A Gmail recipient rejection should be investigated using the Gmail diagnostic, not Exchange relay settings alone.
550 5.7.25: This is a different enhanced code. Follow the exact sending-host identification, reverse DNS, and policy details in the NDR instead of assuming the generic 5.7.1 procedure applies.
550 5.7.1_etr or Command rejected: Keep the full suffix and hostname from the NDR. A short suffix or generic phrase is not enough to identify the responsible rule without the rejecting server's diagnostic or administrator logs.
Exchange Server versus Exchange Online: On-premises Microsoft Exchange Server uses receive/send connectors and transport logs specific to the installed Exchange Server version. The cloud-based Exchange admin center paths above apply to Exchange Online. Older instructions mentioning a Default SMTP Virtual Server are not the current Exchange Online workflow.
Part 5. What If Your Local Outlook Email Files Are Missing?
Fixing SMTP 550 5.7.1 will not recover lost emails. An NDR reports message delivery failure; it is not evidence that local PST or EML files were deleted. If you separately discover that a PST export or locally saved EML backup was deleted from your Windows drive, stop writing new data to the affected disk, first check available backups, and save any recovered files to a different healthy location.
For this separate file-loss scenario, Wondershare Recoverit email file recovery can scan a supported local storage device for lost files. It does not change Exchange SMTP permissions, retrieve mail that was never delivered, or repair an online Exchange mailbox database.
Missing an Outlook PST or EML Backup? Check Your Drive
SMTP 550 5.7.1 needs an Exchange mail-flow fix. But if your Outlook PST archive or saved EML backup was accidentally deleted, Recoverit can scan supported local drives for recoverable email files. Find potential copies and restore them to a separate drive.
Use Recoverit only for an actual locally lost file, not as a step in the NDR troubleshooting workflow. If the message never reached the destination, ask the sender for a corrected resend once the permission or routing issue is resolved.
Conclusion
To fix SMTP error 550 5.7.1 in Exchange Online, start with the full NDR, use message trace to find the rejection, and then fix the specific recipient policy or authorized SMTP path. For an application that sends mail through Microsoft 365, confirm the actual submission or relay method before changing ports, connectors, or authentication. A successful test delivery and matching message trace are stronger evidence than simply making an error message disappear.
FAQ
-
What does 550 5.7.1 relaying denied mean?
The server refused to act as an SMTP relay for that message. The sending application may be using the wrong host or the configured relay may not authorize the sender, source IP, or recipient route. Read the full NDR to confirm the rejecting system. -
What is the Exchange Online SMTP server and port?
For SMTP AUTH client submission, Microsoft documents smtp.office365.com with STARTTLS, typically on port 587. Connector-based relay uses the organization's MX endpoint and normally port 25. These routes have different security and authorization requirements. -
Does SmtpClientAuthenticationDisabled mean SMTP is off for everyone?
No. This setting may apply at the tenant or individual mailbox level. A mailbox override can differ from the organization setting. Check both the selected mailbox's setting and tenant security policy in Microsoft documentation. -
Can Recoverit fix error 550 5.7.1?
No. Recoverit is for recovering lost local files from supported storage, not changing mail server relay or recipient permissions. Fix the Exchange delivery problem through the NDR, message trace, and appropriate administrator settings.
