"554 5.7.1 Relay access denied" when sending

What it means

When you send an email, you get an error like:

554 5.7.1 <someone@example.com>: Relay access denied

"Relay" means passing an email on to another domain. A mail server only does this for people it trusts, usually users who have logged in with a username and password. If the server does not know who you are, it refuses, so it does not become an "open relay" that spammers could abuse.

In short: the server you are sending through does not recognise you as one of its users.

Why it matters

• Your email is not sent at all.
• It often appears after setting up a new mail app, a website plugin, a printer or scanner, or after changing password or provider.
• The error is a good sign about the server: it is protecting itself. Do not "fix" it by opening the server to everyone.

How to check

• Look at your outgoing (SMTP) settings in the app, plugin or device that shows the error.
• Test another recipient: if emails to your own domain work but emails to other domains fail, it is a relay problem, not a problem with the recipient.
• Once sending works, send a test email to the address on the Delivmail home page / to check SPF, DKIM and DMARC.

How to fix it

1. Turn on SMTP authentication. In the outgoing server settings, enable "My outgoing server requires authentication" and enter the full email address and password.
2. Use the right port and encryption. Usually port 587 with STARTTLS, or 465 with SSL/TLS. Port 25 is meant for server-to-server traffic and often does not accept logins.
3. Use the right server name, as given by your provider: for example smtp.gmail.com for Google Workspace or smtp.office365.com for Microsoft 365.
4. Check the password. If the account uses two-step verification, some providers require an app password instead of the normal one.
5. Check the From address. Many servers refuse to send for a domain that is not yours. Send from an address on the account you log in with.

If you run the mail server

Allow relaying only for authenticated users and for trusted internal IP addresses. In Postfix this is done with smtpd_relay_restrictions, for example:

smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

Never add the whole internet to mynetworks.

Check that it is fixed

Send an email to an outside address, such as a Gmail address you own: it should leave without error. Then send a test email to the address on the home page and open the report to confirm the email is authenticated and not blacklisted.