Microsoft "550 5.7.509 ... does not pass DMARC verification and has a DMARC policy of reject": how to fix it

What it means

Your domain publishes a DMARC policy of reject, which tells receivers: "If an email claiming to be from us fails DMARC, refuse it." Microsoft (Outlook.com and Microsoft 365) did exactly that. The bounce usually looks like this:

550 5.7.509 Access denied, sending domain yourdomain.com does not pass
DMARC verification and has a DMARC policy of reject.

DMARC passes only if SPF or DKIM passes and the domain checked matches the domain in the visible From address. This is called alignment.

Why it happens

• A sending service is not authenticated for your domain: a newsletter tool, CRM, shop or website sends with your From address but without your DKIM key and from servers not in your SPF.
• SPF passes but is not aligned: the service uses its own bounce domain, so SPF passes for the service's domain, not yours.
• DKIM signs with the wrong domain: the email is signed with the provider's default domain instead of yours.
• Forwarding: an email forwarded by another server can break SPF, and a mailing list that changes the content can break DKIM.
• Spoofing: someone else is sending fake emails with your domain. Here the rejection is DMARC doing its job.

How to check

• Send a test email: on the Delivmail home page (/), copy your unique test address and send it a normal email from the same server, tool or mailbox that bounced. Open the report when it is ready.
• Read the DMARC section. It shows whether SPF and DKIM pass and whether each one is aligned with your From domain.
• Check your records on /domain-scanner: one SPF record, a DMARC record, and DKIM where possible.
• Read your DMARC aggregate reports to find every service sending as your domain. The Delivmail paid dashboard reads and summarises these reports for you.

How to fix it

1. Identify the service that sent the rejected email. Look at the bounce and at the headers of the original message.
2. Set up DKIM with your own domain in that service. Most tools give you one or more DNS records (TXT or CNAME) to publish. DKIM is the most reliable way to pass DMARC, because it survives forwarding.
3. Add the service to your SPF record if it sends from its own servers, and set up a custom bounce (return-path) domain on your domain if the service offers it.
4. Keep one SPF record and stay under 10 DNS lookups.
5. If you cannot fix it quickly, temporarily lower your policy to p=quarantine or p=none while you fix the service. Go back to reject once all your services pass.
6. If the emails are not yours, do nothing on DMARC: p=reject is protecting your domain.

Check that it is fixed

Wait for the DNS changes to spread (usually minutes, sometimes a few hours). Send a new email from the same service to a new Delivmail test address and check that DMARC passes with SPF or DKIM aligned. Then send again to the Microsoft address that bounced. Keep watching your DMARC reports for other services that still fail.