Microsoft forwarding authentication error

Fix Outlook 550 5.7.367 relay rejection

Microsoft documents 5.7.367 as a relay rejection caused by SPF or DKIM failures in forwarded or relayed mail. Map every gateway hop before changing the source domain's records.

Problem description

The NDR contains:

550 5.7.367 Remote server returned not permitted to relay

What MailFixIt can test: current SPF, a supplied sender path, exact DKIM selector DNS, and reported header results. It cannot reconstruct private connector policy or gateway transformations.

Is this temporary or permanent?

The 550 response is permanent for this attempt. Correct the relay/authentication path and send a new message.

Trace the failing hop

A forwarder changes the connecting IP and breaks SPF.
A gateway modifies signed content and breaks DKIM.
The relay does not preserve authentication evidence.
A connector is scoped to the wrong domains, certificates, or source addresses.

How to resolve it

Preserve all Received, Authentication-Results, ARC, and DKIM headers.
Identify the original sender, every gateway, and Microsoft ingress.
Check SPF for the identity evaluated at the failing hop.
Verify DKIM before and after gateway processing.
Correct the gateway or connector and retest the same route.

Frequently asked questions

What causes Microsoft 5.7.367?

Microsoft documents SPF or DKIM authentication failures in forwarded or relayed mail, especially through non-Microsoft gateways.

Can forwarding break SPF?

Yes. A forwarder changes the connecting IP while the original envelope identity may remain, so SPF can fail.

Does current DNS prove the forwarded message passed?

No. Preserve the original headers and relay path; current records are only part of the evidence.

Related email diagnostics

Primary sources: Microsoft Exchange Online NDR reference, RFC 7208 SPF, and RFC 6376 DKIM.