Microsoft SMTP identity rejection

Fix Outlook 550 5.7.506 bad HELO

Microsoft documents 5.7.506 as Bad HELO. The server that connects to Microsoft is announcing an invalid or unacceptable SMTP identity; correct that outbound MTA or relay rather than changing unrelated email authentication records.

Problem description

The Microsoft NDR can contain:

550 5.7.506 Access denied, bad HELO

Diagnostic availability: MailFixIt does not currently accept a HELO hostname or inspect an SMTP session. Use the sending server's logs and configuration.

Is this temporary or permanent?

The 550 response is permanent for this attempt. Correct the announced identity and send a new message.

Probable causes

The MTA announces localhost, a bare label, an IP literal in an unacceptable form, or a nonexistent name.
A NAT, gateway, or relay uses an unexpected hostname.
The hostname has no coherent forward/reverse DNS relationship.
A tenant connector expects a different sending identity.

Manual resolution

Find the final outbound server in delivery logs.
Record the exact EHLO/HELO value it sent.
Configure a stable fully qualified hostname owned by the operator.
Publish correct forward DNS and coordinate reverse DNS with the IP owner where applicable.
Check connector restrictions, then send a new test.

Frequently asked questions

What is HELO or EHLO?

It is the identity a sending SMTP server announces when opening a mail session.

Should HELO be my visible From domain?

Not necessarily. It should normally be a stable fully qualified hostname for the actual sending server with coherent DNS.

Does MailFixIt currently validate HELO?

No. The current checker has no HELO input or SMTP-session observation.

Related email diagnostics

Primary sources: Microsoft Exchange Online NDR reference and RFC 5321 SMTP.