5.7.367 Microsoft bounce: forwarded mail refused
What 5.7.367 means
A forwarded or relayed message from Microsoft 365 was refused because SPF or DKIM failed further along the route.
Message text
Remote server returned not permitted to relay
Common causes of 5.7.367
- SPF or DKIM failure in forwarded or relayed mail
- Often seen when a non-Microsoft gateway sits in the mail flow
How to fix 5.7.367
- Run DKIM checker and SPF checker for the domain that sent the original message.
- Ask the forwarding or gateway service to keep the original DKIM signature intact.
Check your domain
Check the SPF record of your sending domainRuns in your browser; nothing is uploaded.
Get your domain's deliverability score
Have the full bounce message? Paste it into the bounce code lookup and it will match the code and the provider for you. Open the bounce code lookup.
How to read 5.7.367
The second part, 5.7.367, is an enhanced status code (RFC 3463 §2) written class.subject.detail. Class 5 is a Permanent failure (5xx): the command was rejected and the sender should not repeat it unchanged (RFC 5321 §4.2.1; RFC 3463 §2).. Subject 7 is security or policy: authentication, authorization or policy refused the message. The detail number refines the subject, and providers may define details of their own, which is why one code can read differently at Gmail, Microsoft and Yahoo.
Do not keep resending the same message: a permanent failure repeats until the cause is fixed. Correct the cause, then send a new message.
Official source: learn.microsoft.com. Last verified 2026-10-20.
Related guides
- How to create an SPF record (syntax and examples)
- How DKIM works and how to publish a DKIM record
- How to set up a DMARC record, from p=none to p=reject
Related codes
- 5.7.0 SMTP: security status
- 5.7.1 SMTP: delivery not authorized
- 5.7.23 SMTP: SPF validation failed
- 5.7.25 SMTP: reverse DNS failed
- 5.7.26 SMTP: authentication failed
- 5.7.27 SMTP: sender has null MX
FAQ
What does 5.7.367 mean?
A forwarded or relayed message from Microsoft 365 was refused because SPF or DKIM failed further along the route. This is a permanent failure.
How do I fix 5.7.367?
Run DKIM checker and SPF checker for the domain that sent the original message. Ask the forwarding or gateway service to keep the original DKIM signature intact.
Is 5.7.367 permanent, and should I retry?
5.7.367 is a permanent failure, so retrying the same message will fail again. Fix the cause first, then send a new message.