The bounce 550 5.7.515 Access denied, sending domain does not meet the required authentication level means Outlook.com, Hotmail or Live refused your email because your domain failed Microsoft's authentication checks. Since 5 May 2025 Microsoft rejects messages from domains sending in volume that don't pass SPF, DKIM and DMARC, rather than just sending them to junk.
Who sees this bounce
Anyone sending to people with Outlook.com, Hotmail or Live addresses: your customers' personal email. It often shows up first on newsletters, invoices or booking confirmations sent from another service, because those are the messages least likely to be authenticated as your domain.
How to fix it
- Check your domain has one valid SPF record that includes every service that sends for you.
- Turn on DKIM in each of those services and publish their keys.
- Publish a DMARC record (at least
p=noneto start). - Make sure the From domain matches the domain that passes SPF or DKIM. This "alignment" is what most set-ups miss.
How long until it works
Once the records are right, new messages should deliver as soon as the DNS changes spread, usually within an hour or two. Messages that already bounced need resending.
If you'd rather it was sorted today, book our email deliverability fix.
