5.7.509: rejected by the DMARC policy
By Jose Pollman · Published
Hard bounceYour authentication setup
The error
550 5.7.509 Access denied, sending domain does not pass DMARC verification
550 5.7.1 Unauthenticated email from example.com is not accepted due to domain's DMARC policyWhat it means
The From domain publishes a DMARC policy of reject or quarantine, and this message did not pass an aligned SPF or DKIM check, so the receiver honoured that policy.
Your mail is not proving it came from you. SPF, DKIM or DMARC is missing or failing.
Why it happens
Almost always alignment rather than a failed check. A vendor can pass SPF perfectly for its own envelope domain and still fail DMARC, because DMARC compares the passing domain against the one in your From header. That trap catches more senders than every other DMARC problem combined.
How to fix it
- If you own the From domain, this is an unauthorised sender — authenticate it or stop it.
- If you are forwarding mail, expect this: forwarding breaks SPF, and only a surviving DKIM signature saves it.
- Check DMARC alignment rather than just whether SPF or DKIM passed.
Related guides
- 5.7.9: authentication required or signature invalid — The receiver required authentication that was absent or invalid — commonly a DKIM signature that did not verify.
- Gmail 550 5.7.26: this mail is unauthenticated — Gmail rejected the message because it could not verify that you sent it. Gmail requires every sender to pass either SPF or DKIM, aligned with the domain in your From address, and this message passed neither.
- Microsoft 5.7.23: SPF violation — The receiving Microsoft system checked your SPF record and the sending IP was not authorised by it.