We send fewer than 5,000 emails a day. Why are we getting this code?

Microsoft's published threshold is 5,000 a day, but its filters apply the same authentication checks to everyone, and a domain with no SPF or DKIM at all can be refused at any volume. Setting up all three is the fix either way, and it takes the same half hour.

Our IT provider set up SPF years ago. Isn't that enough?

Not any more. SPF alone was acceptable until 2024. Microsoft, Google and Yahoo now expect DKIM and DMARC as well. The check above will show SPF passing and the other two missing, which is the most common pattern behind this bounce.

Is 550 5.7.15 the same as 550 5.7.1?

No. 5.7.1 is a general "unauthorised" refusal that can mean a blocklist, a bad reputation or a policy on the recipient's side. 5.7.15 is specifically about your domain's authentication settings, which is good news: it is the one you can fix yourself.

Guide550 5.7.15

Emails bouncing with 550 5.7.15 from Outlook or Hotmail

550 5.7.15 is the code Microsoft returns when it refuses an email because the sending domain does not meet its authentication requirements. Since May 2025, mail to Outlook.com, Hotmail and Live addresses from domains without SPF, DKIM and a DMARC record is rejected rather than filtered, and the bounce message quotes this code. It is a settings problem on your domain, not a problem with the recipient. Check your domain below to see which of the three is missing.

See it on your own domainSender requirements checker

What Microsoft is asking for

Three public settings on your domain, all aligned with the address in your From line: SPF, a list of the services allowed to send as you; DKIM, a digital seal your email provider adds to each message; and DMARC, a record that tells receivers what to do with email that fails the first two. Microsoft's rule for high-volume senders requires all three, with DMARC at least in monitoring mode. The bounce text usually reads like "550 5.7.15 Access denied, sending domain does not meet the required authentication level".

Why it started suddenly

Nothing changed on your side; Microsoft's enforcement did. Domains that had sent to Hotmail and Outlook addresses for years with only SPF, or with nothing at all, began bouncing on the day the rule took effect, and Microsoft has tightened it since. If several people at your company started seeing bounces at once, this is why.

How to fix it

Run the check above. The result names which of the three settings is missing or broken and gives step-by-step instructions for your domain host (GoDaddy, Cloudflare, Namecheap, Squarespace and others) with the exact values to copy. Most businesses are done in 15 to 30 minutes. Publish DMARC in monitoring mode first, which satisfies Microsoft without blocking any of your own email. Then check again, and the bounces stop as soon as your DNS change has spread, usually within the hour.

Common questions

We send fewer than 5,000 emails a day. Why are we getting this code?: Microsoft's published threshold is 5,000 a day, but its filters apply the same authentication checks to everyone, and a domain with no SPF or DKIM at all can be refused at any volume. Setting up all three is the fix either way, and it takes the same half hour.
Our IT provider set up SPF years ago. Isn't that enough?: Not any more. SPF alone was acceptable until 2024. Microsoft, Google and Yahoo now expect DKIM and DMARC as well. The check above will show SPF passing and the other two missing, which is the most common pattern behind this bounce.
Is 550 5.7.15 the same as 550 5.7.1?: No. 5.7.1 is a general "unauthorised" refusal that can mean a blocklist, a bad reputation or a policy on the recipient's side. 5.7.15 is specifically about your domain's authentication settings, which is good news: it is the one you can fix yourself.