Outlook.com "550 5.7.515 Access denied, sending domain doesn't meet the required authentication level": how to fix it

What it means

Since 2025, Microsoft requires domains that send a lot of email to consumer mailboxes (Outlook.com, Hotmail.com, Live.com) to be properly authenticated. If your domain does not meet these rules, the email is refused with this message:

550 5.7.515 Access denied, sending domain [yourdomain.com] doesn't meet
the required authentication level.

The rules mainly target senders of more than about 5,000 emails per day to these mailboxes, but meeting them is good practice for everyone.

Why it happens

Microsoft's requirements for high-volume senders are:

• SPF must pass for the sending domain: your SPF record must list the servers that send your email.
• DKIM must pass: the email must carry a valid DKIM signature.
• DMARC must be published with at least p=none, and it must pass, with SPF or DKIM aligned with the domain in the From address (ideally both).

The error appears when one of these is missing or failing. Typical cases:

• No DMARC record at all.
• A newsletter or marketing tool sending without DKIM for your domain.
• SPF that does not include the tool, or that has a syntax error or too many lookups.
• DKIM signing with the provider's domain instead of yours, so it does not align.

Microsoft also recommends a working unsubscribe link, valid From and Reply-To addresses, and regular list cleaning.

How to check

• Send a test email: on the Delivmail home page (/), copy your unique test address and send it a normal email from the same server, tool or mailbox that bounced. Open the report when it is ready.
• Read the SPF, DKIM and DMARC sections of the report: all three should pass, and DMARC should show alignment.
• Run the Domain scanner at /domain-scanner to check that your domain has a single valid SPF record and a DMARC record.
• Repeat for every tool that sends to your customers: mailbox, newsletter tool, shop, CRM.

How to fix it

1. Publish a DMARC record if you have none. A safe starting point is:

   _dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

2. Fix SPF. Keep one record that includes every service sending for you, for example v=spf1 include:spf.provider-example.com ~all, and stay under 10 DNS lookups.
3. Turn on DKIM with your own domain in each sending tool. Publish the TXT or CNAME records it gives you, then click "Verify" in the tool.
4. Align the domains. The domain in the From address should match the DKIM signing domain, and ideally the return-path (bounce) domain used by SPF. Many tools let you set a custom return path on your domain.
5. Add a clear unsubscribe link to marketing emails and remove addresses that bounce.

Check that it is fixed

Wait for the DNS changes to spread. Send a new email from each tool to a new Delivmail test address and confirm that SPF, DKIM and DMARC all pass with alignment. Then send again to the Outlook.com or Hotmail address that bounced. Once authentication is correct, this specific error should stop; other filters can still apply, so keep your lists clean.