Fix Outlook error 550 5.7.515: required authentication level

What the error says

Microsoft documents the bounce as: 550 5.7.515 Access denied, sending domain <domain> does not meet the required authentication level. It comes from Outlook.com consumer mail (Outlook.com, Hotmail, Live.com).

Cause

Microsoft's high-volume sender requirements apply to domains sending 5,000 or more messages a day to Outlook.com. Such senders must publish SPF and DKIM, publish a DMARC record, and pass DMARC by aligning SPF or DKIM with the From domain. Microsoft said non-compliant mail would first go to Junk, with rejection to follow.

How to fix it

  1. Publish SPF including every service that sends for you: 
    example.com.  TXT  "v=spf1 include:spf.protection.outlook.com include:mailgun.org -all"
  2. Configure DKIM so messages are signed with d=example.com, not the vendor's domain.
  3. Publish DMARC (Microsoft's own example is p=none): 
    _dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
  4. Make the return-path (MAIL FROM) domain or the DKIM domain match your From domain so DMARC aligns.
  5. Read a delivered message's Authentication-Results header to confirm spf, dkim and dmarc all show pass.

Check your domain

Not sure what your domain publishes today? The checker reads your live DNS and shows what is missing. If you would rather skip the trial and error, the $29 Email Fix Pack is the fastest route: ready-to-paste records for your domain.

Check your domain free

Sources

More email delivery fixes