5.7.509 Microsoft bounce: DMARC reject
What 5.7.509 means
The From domain publishes a DMARC policy of reject, and the message did not pass DMARC, so it was rejected.
Message text
Access denied, sending domain [$SenderDomain] does not pass DMARC verification and has a DMARC policy of reject.
Common causes of 5.7.509
- SPF and DKIM do not align with the From domain
- Forwarding changed the message without ARC
How to fix 5.7.509
- Run DMARC checker on the From domain.
- Run SPF checker and DKIM checker and make the signing domain match the From domain.
- Use email header analyzer to read the Authentication-Results header.
Check your domain
Check the SPF record of your sending domainRuns in your browser; nothing is uploaded.
Get your domain's deliverability score
Have the full bounce message? Paste it into the bounce code lookup and it will match the code and the provider for you. Open the bounce code lookup.
How to read 5.7.509
The second part, 5.7.509, is an enhanced status code (RFC 3463 §2) written class.subject.detail. Class 5 is a Permanent failure (5xx): the command was rejected and the sender should not repeat it unchanged (RFC 5321 §4.2.1; RFC 3463 §2).. Subject 7 is security or policy: authentication, authorization or policy refused the message. The detail number refines the subject, and providers may define details of their own, which is why one code can read differently at Gmail, Microsoft and Yahoo.
Do not keep resending the same message: a permanent failure repeats until the cause is fixed. Correct the cause, then send a new message.
Official source: learn.microsoft.com. Last verified 2026-10-20.
Related guides
- DMARC fails even though SPF and DKIM pass: fixing alignment
- How to set up a DMARC record, from p=none to p=reject
- DMARC p=none to quarantine to reject: a safe rollout
Related codes
- 5.7.0 SMTP: security status
- 5.7.1 SMTP: delivery not authorized
- 5.7.23 SMTP: SPF validation failed
- 5.7.25 SMTP: reverse DNS failed
- 5.7.26 SMTP: authentication failed
- 5.7.27 SMTP: sender has null MX
FAQ
What does 5.7.509 mean?
The From domain publishes a DMARC policy of reject, and the message did not pass DMARC, so it was rejected. This is a permanent failure.
How do I fix 5.7.509?
Run DMARC checker on the From domain. Run SPF checker and DKIM checker and make the signing domain match the From domain. Use email header analyzer to read the Authentication-Results header.
Is 5.7.509 permanent, and should I retry?
5.7.509 is a permanent failure, so retrying the same message will fail again. Fix the cause first, then send a new message.