550 5.7.509: sending domain fails DMARC and its policy is reject
Likely causes
- A service sends as your domain (newsletter, CRM, ticketing tool) but isn't in your SPF record or signing with DKIM for your domain.
- SPF or DKIM passes, but for a different domain than the one in the From address, so it doesn't align.
- The message was forwarded or changed on the way, which broke DKIM.
- Someone is spoofing the domain, and the rejection is working as intended.
How to fix it
- Tell the sender’s email admin. Only the owner of the sending domain can fix this.
- Sender’s admin: find which system sent the message (check the headers) and make sure it’s covered by SPF and signs with DKIM for the From domain.
- Sender’s admin: check that SPF or DKIM passes for the same domain shown in the From address.
- Once every real sending service is set up, the DMARC policy can stay at reject. Don’t lower the policy to hide a setup problem.
Checked against: learn.microsoft.com, learn.microsoft.com