Outlook 550 5.7.515: "sending domain does not meet the required authentication level"

If Outlook.com or Hotmail rejects your mail with 550 5.7.515 Access denied, sending domain [yourdomain] does not meet the required authentication level, Microsoft is enforcing its high-volume sender rules against you. Here is what they check and the order I would fix it in.

What Microsoft is asking for

For domains sending large volumes to Outlook.com consumer mailboxes, Microsoft requires:

• SPF passing, with the sending IP authorised.
• DKIM signing with a valid signature.
• DMARC published, with at least p=none, and the message aligned with either SPF or DKIM.

Failing any of these puts the domain in the rejection path. The bounce is about the domain's authentication, not about your message content.

1. Find out what is actually failing

Get a delivered copy of a message to an Outlook address if you can, or look at the failed bounce. Read Authentication-Results. You want spf=pass, dkim=pass and dmarc=pass. Note which one is not.

2. The most common cause: alignment, not absence

Many senders have SPF and DKIM "passing", but for the wrong domain. Mail sent through a third-party platform often passes SPF for the platform's own bounce domain and DKIM signed as the platform. DMARC needs one of those domains to match your visible From domain. Set up the platform's custom domain authentication (a DKIM CNAME at your domain, and a custom return-path) so that the passing check is for your domain.

3. Publish DMARC if it is missing

Start with monitoring only:

_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

Only move to quarantine or reject after the reports show every legitimate sender passing.

4. Check every sender, not just the main one

Your own mail server may be fine while the newsletter tool, the invoicing app, and the CRM are the ones failing. Each system that sends as your domain needs to pass.

5. After you fix it

Allow time for DNS to propagate, then send a fresh test. A domain that has been rejected can take a while to recover reputation, so do not expect an instant flip, and do not resend the same bulk batch repeatedly.

What to take from this

Authentication is not a one-time setup. Senders get added, DKIM keys get rotated, a vendor changes their return-path, and alignment quietly breaks. The sending domains I see rejected have almost always passed at some point before. What matters is noticing the day it changes, not discovering it from a bounce.

If you would like to see how your own domain looks right now, Email Fix Pack has a free checker for live SPF, DKIM and DMARC (disclosure: I made it).