The short version
Read the whole line, not just the number. The first digit says whether
it’s temporary (4, the receiver is slowing you down and the message
will be retried) or a refusal (5). The 5.7.x part says it’s a policy
or security reason. The text after it says which check failed, and that
decides the fix.
Gmail
From Google’s SMTP error reference, read on 9 November 2026:
| Bounce | What failed | The fix |
|---|---|---|
550 5.7.26 “Unauthenticated email from [domain] is not accepted due to domain’s DMARC policy” |
DMARC, and the domain’s policy is reject | Find the sender in your reports and give it aligned SPF or DKIM; if it’s not yours, the bounce is DMARC working |
550 5.7.26 “This email has been blocked because the sender is unauthenticated” |
Neither SPF nor DKIM passed | Add the sender to SPF, or turn on its DKIM |
550 5.7.27 / 421 4.7.27 |
SPF | Check the record with the SPF Check: a missing sender, or more than 10 lookups |
550 5.7.30 / 421 4.7.30 |
DKIM | Check the selector with the DKIM Inspector |
5.7.32 / 4.7.32 |
Alignment: the From domain matches neither the SPF nor the DKIM domain | Set the sender up to send with your domain’s DKIM, or a return path on your domain |
550 5.7.40 / 421 4.7.40 |
The sending domain has no DMARC record, or an invalid one | Publish one: v=DMARC1; p=none; rua=mailto:... |
Outlook.com and Microsoft 365
From Microsoft’s Exchange Online NDR reference and its high-volume sender requirements:
| Bounce | What failed | The fix |
|---|---|---|
550 5.7.509 “Access denied, sending domain [domain] does not pass DMARC verification and has a DMARC policy of reject” |
DMARC, and the domain’s policy is reject | As Gmail’s 5.7.26: align the sender, or accept that it was spoofed |
550 5.7.515 “Access denied, sending domain [domain] does not meet the required authentication level” |
A sender of more than 5,000 messages a day without SPF, DKIM and DMARC in place | Pass SPF and DKIM, and publish DMARC at p=none or stronger, aligned |
550 5.7.23 “The message was rejected because of Sender Policy Framework violation” |
SPF | Check the record with the SPF Check |
550 5.7.1 “Message rejected: Message lacks SPF/DKIM/DMARC Auth Records” |
No DMARC record (seen since November 2026, not announced) | Publish DMARC; see the Outlook.com post |
5.7.1 on its own means only “refused for a policy reason”. Microsoft and
others use it for many different refusals, so the text is what tells you
whether it’s authentication at all.
Which domain to look at
A bounce names the domain whose policy or records were checked. That is
the domain in the From address of the message, which isn’t always
the domain of the mailbox that sent it. A bounce for example.com sent
by your helpdesk tool is a problem with how the helpdesk sends as
example.com, not with your mailbox provider.
When it isn’t yours
A bounce can be for mail you never sent: someone spoofed your domain, the
receiver checked your DMARC policy and refused it. If you’re at
p=reject, that’s the point. The aggregate reports show the server it
came from; if you don’t recognise it, there’s nothing to fix.
The Domain Checker shows SPF, DMARC and DKIM for a domain in one look, which is usually enough to see which of the three a bounce is about.