Microsoft documents two sources for 550 5.7.1 errors in Exchange Online. Unable to Relay errors appear when a sender IP address sits on both the incoming connector and your IP Allow list. Remove the IP from the Allow list and the next error names the blocklist. Wider 550 5.7.1 errors need a fix on the recipient or admin side.
Your outgoing or incoming mail bounces with a 5.7.1 error. Error wording shows which documented cause applies.
Facts follow two Microsoft Learn articles, one on Unable to Relay errors and one on 550 5.7.1 errors in Exchange Online. Both articles describe Exchange Online. Microsoft gives no relay steps for on premises servers.
What Causes Unable to Relay Failures?
External mail servers cannot connect to Microsoft 365 because their IP address is on a blocklist. Senders see 5.7.1. Unable To Relay: Blocked by Customer Allow list and the message names no blocklist. Microsoft states the case occurs when the sender IP sits on both the incoming connector and in your IP Allow list on the Connection Filtering page of the Exchange admin center.
How to Fix Unable to Relay Errors?
- Delete the external server IP entry under IP Allow list on the Connection Filtering page.
- Ask the sender to retry or wait for the message to retry.
- Check the new error. It names the blocklist that blocks the IP.
- Resolve the listing with that blocklist.
Microsoft adds that only on premises IP addresses should be in connector settings.
What Causes a General 550 5.7.1 Error?
- Permission. Senders lack permission to send to the recipient or the group.
- Server permission. Senders lack permission to send through a mail server between sender and recipient.
- Routing. Exchange routed the message to the wrong server.
- Blocklist. Some NDRs show a blocklist name. Forward it to delist@microsoft.com or use the delist portal.
Which Admin Checks Apply?
- Domain status. Confirm the domain shows Healthy under Settings and Domains.
- MX record. Use
domain.mail.protection.outlook.comand one MX record only. - SPF record. Include every source of mail for the domain.
- Connectors. Check Mail Flow then Connectors in hybrid setups.
Microsoft states senders cannot fix a general 550 5.7.1 error alone. Recipients or their admins must update the configuration. Related reading: how to encrypt Outlook emails and how to enable multifactor authentication in Microsoft 365.
Frequently Asked Questions
What is 550 5.7.1 Unable to Relay?
Sending server IP addresses on a blocklist trigger it. Microsoft ties one variant to an IP on both the incoming connector and your IP Allow list.
How do I Fix Unable to Relay in Exchange Online?
Delete the sender IP from your Allow list and check the next error for the blocklist name.
Can the Sender Fix a 550 5.7.1 Error?
Rarely. Microsoft states recipients or their admins must update the configuration.
Which MX Record is Used by Microsoft 365?
Microsoft lists domain.mail.protection.outlook.com or domain.subdomain.mx.microsoft and one MX record only.
Key Takeaways
- Microsoft links Unable to Relay to an IP on both the connector and the Allow list.
- Removing the IP reveals the blocklist name.
- General 550 5.7.1 errors need recipient or admin action.
- Use one MX record that points to Microsoft 365.
- Microsoft gives no relay steps for on premises servers.
Sources and References
Facts follow Microsoft Learn.
- NDR error 5.7.1 Unable To Relay: Blocked by Customer Allow list (Microsoft Learn) learn.microsoft.com
- Fix NDR error 550 5.7.1 in Exchange Online (Microsoft Learn) learn.microsoft.com