Microsoft 365 "550 5.7.1 RESOLVER.RST.AuthRequired": how to fix it

What it means

You sent an email to an address hosted on Microsoft 365, usually a group (distribution list, Microsoft 365 group, Teams team address), a mail-enabled public folder or a restricted mailbox. That recipient is set to accept messages only from authenticated senders, meaning people signed in to the same organization. You are outside it, so the message was refused. Microsoft documents this text for public folders:

Remote Server returned '<xxxxxxxx> #5.7.1 smtp;550 5.7.1 RESOLVER.RST.AuthRequired; authentication required [Stage: CreateMessage]'

RESOLVER.RST means "recipient restriction". Recent bounces often show a more specific code instead of 5.7.1:

• 5.7.133: sender not authenticated for group.
• 5.7.134: sender not authenticated for mailbox.
• 5.7.13 or 5.7.135: sender not authenticated for public folder.
• 5.7.136: sender not authenticated for a mail user.

The human-readable part usually says the group "only accepts messages from people in its organization or on its allowed senders list".

Why it happens

This is a setting, not a spam decision. Your SPF, DKIM and IP reputation have nothing to do with it. Typical situations:

• A company creates sales@ or support@ as a distribution group or Microsoft 365 group. By default these groups accept only internal senders, so customers' emails bounce.
• A Teams team's email address, or a public folder used as a shared inbox, was never opened to outside senders.
• An admin restricted a mailbox to internal senders on purpose.
• A website contact form sends to a group address through an external service, which counts as an outside sender.

If the bounce says 5.7.124 Sender not in allowed-senders list instead, the group accepts only a named list of senders; the fix is to add the sender to that list.

How to check

1. Read the bounce: it names the restricted recipient and, with 5.7.133 to 5.7.136, its type.
2. If you are the sender, check the address really belongs to the organization you want (look at its MX with the Delivmail domain scanner), then contact them another way and forward them the bounce.
3. If you are the admin, check the setting in Exchange Online PowerShell:

   Get-DistributionGroup sales@yourdomain.com | Format-List RequireSenderAuthenticationEnabled,AcceptMessagesOnlyFromSendersOrMembers
   Get-UnifiedGroup sales@yourdomain.com | Format-List RequireSenderAuthenticationEnabled
   Get-MailPublicFolder support@yourdomain.com | Format-List RequireSenderAuthenticationEnabled
   Get-Mailbox info@yourdomain.com | Format-List RequireSenderAuthenticationEnabled

   True means only internal, authenticated senders are accepted.

How to fix it

Only the recipient's admin (or the group owner) can change this. Decide first whether outside people should be able to write to the address: allowing everyone also allows spam and phishing to reach all group members.

Distribution group

In the Exchange admin center, open Recipients > Groups, select the group, then Settings and tick the option that allows people outside the organization to send to it. Or:

Set-DistributionGroup sales@yourdomain.com -RequireSenderAuthenticationEnabled $false

Microsoft 365 group or Teams team

In the Microsoft 365 admin center, go to Teams & groups > Active teams & groups, open the group, and in its settings enable the option to let people outside the organization email the team. Or:

Set-UnifiedGroup sales@yourdomain.com -RequireSenderAuthenticationEnabled $false

Mail-enabled public folder

Microsoft's steps: Exchange admin center, Public folders, edit the folder, Mail flow settings, then under Message Delivery Restrictions > Accept messages from, clear Require that all senders are authenticated and select All senders. Or:

Set-MailPublicFolder support@yourdomain.com -RequireSenderAuthenticationEnabled $false

Mailbox

Set-Mailbox info@yourdomain.com -RequireSenderAuthenticationEnabled $false

Safer alternatives

• For a shared address like support@, use a shared mailbox: it accepts outside mail by default and keeps one copy instead of sending to every member.
• To open a group to only one partner, add their address as a mail contact and put it in the group's allowed senders list rather than opening it to everyone.
• Groups with more than 5,000 members have extra restrictions (moderation); Microsoft documents them separately.

Opening a group to outside senders does not stop Microsoft's filters from checking those messages. Mail from senders with weak authentication can still go to junk, as explained in emails go to Outlook junk.

Check that it is fixed

• Changes can take some time to replicate. Then send a test from an outside mailbox (for example a personal address) to the group or folder.
• If the original sender still gets a bounce, compare the code: a different code (for example 5.1.10 recipient not found) points to another problem.
• If you are the sender and want to be sure your own setup is clean, send a test to the address on the Delivmail home page.