550 5.7.515 Access Denied - Domain Authentication Required (Microsoft)

When sending emails to Microsoft recipients (Outlook.com, Hotmail, Live.com, MSN), you may encounter a rejection containing the error code 550 5.7.515. This article explains what the error means and how to resolve it.

What Does This Error Look Like?

The bounce message will contain text similar to:

550 5.7.515 Access denied, sending domain [example.com] doesn't meet the
required authentication level. [...] Spf=Pass, Dkim=Fail, DMARC=Pass

The key part is the 5.7.515 error code and the authentication results at the end of the message. In the example above, DKIM is failing — but your specific results may vary. Check which of the three (SPF, DKIM, DMARC) shows a status other than Pass.

What Does This Error Mean?

Microsoft requires domains sending to their consumer email services (Outlook.com, Hotmail, Live.com, MSN) to pass all three of the following email authentication checks:

1. SPF — Verifies that the sending server is authorized for your domain
2. DKIM — Verifies a cryptographic signature proving the message is from your domain
3. DMARC — Ties SPF and DKIM together with a policy for your domain

If any of these checks fail, Microsoft may reject the message with a 5.7.515 error. This enforcement applies especially to high-volume senders (5,000+ messages), but Microsoft can apply it at any volume at their discretion.

How to Fix It

Check the authentication results in your bounce message to identify which check is failing, then follow the relevant guide below.

SPF Failing

Ensure your domain has a valid SPF record that includes MXroute. Your SPF record should look like:

v=spf1 include:mxroute.com -all

If you use additional email services alongside MXroute, combine them into a single record:

v=spf1 include:mxroute.com include:other-service.com -all

Your domain must have only one SPF record. See the full guide: SPF Records

DKIM Failing

This is the most common cause of the 5.7.515 error. DKIM must be configured in your DNS using the key from your control panel.

To set up or verify your DKIM record:

1. Go to management.mxroute.com and log in
2. Click Login to Panel
3. Click DNS
4. Locate your DKIM key for the domain
5. Add (or verify) a TXT record in your domain's DNS:

Type	Host/Name	Value
TXT	x._domainkey	Your DKIM key from the panel

Common issues:

• The DKIM record was never added to DNS
• The record was added with incorrect formatting (extra backslashes, duplicate quotes)
• The DNS host/name field doesn't match exactly — it must be x._domainkey

Allow 4–6 hours for DNS propagation after making changes. See the full guide: DKIM Records

DMARC Failing

Ensure your domain has a DMARC record published. A safe starting point:

Type	Host/Name	Value
TXT	_dmarc	v=DMARC1; p=none; sp=none; adkim=r; aspf=r;

See the full guide: DMARC Records

Verifying Your Configuration

After making DNS changes:

1. Wait for DNS propagation (up to 4–6 hours for DKIM, though often faster)
2. Send a test email to mail-tester.com — aim for a 10/10 score
3. Verify that SPF, DKIM, and DMARC all show as passing in the results
4. Try sending to the Microsoft recipient again

Still Having Issues?

If all three authentication checks pass and you're still seeing this error:

• Double-check that your DKIM key in DNS matches the one shown in the panel — keys can change if the domain is removed and re-added
• Confirm that DNS propagation is complete using an online DKIM verification tool
• Review Microsoft's documentation on this error: Fix NDR error 550 5.7.515

If you've verified everything and the problem persists, please create a support ticket with the full bounce message and your domain name.