SMTP 550 5.7.1 relay access denied: causes and fixes
"550 5.7.1 Relaying denied", "Relay access denied", "553 Relaying disallowed" and "550 5.7.64 Relay Access Denied" explained: the server will not forward mail for that From/To combination. Fixes for missing authentication, From-address mismatch, direct send and misconfigured relays.
What 550 means: The server accepted the connection but refuses to relay this message: it does not consider you an authorised sender for that From address, that recipient, or at all. Receiving servers only accept mail for their own domains; sending servers only relay for authenticated or allowlisted senders.
Causes, most likely first — and the fix for each
- No authentication was sent — the client connected to a submission server on port 25/587 but never issued AUTH (or the server does not advertise AUTH on that port).
Fix: Enable SMTP authentication in the client and use port 587 (or 465). Check the client actually sends credentials — many "no auth" defaults exist. - The From address is not one the account may use (Zoho "553 Relaying disallowed", Fastmail "not owned by user", Office 365 "550 5.7.60 Client does not have permissions to send as this sender", relays that require a verified domain).
Fix: Send from the authenticated address, add the alias/identity, or verify the domain at the relay. - You pointed the client at a receiving server (an MX host) instead of a submission server — for example mail.yourdomain.com that only accepts inbound mail, or Office 365 "direct send" to an external recipient ("550 5.7.64 Relay Access Denied").
Fix: Use the provider's outgoing host on 587/465 with authentication; direct send only works for internal recipients. - IP-based relay (Google Workspace relay, Office 365 connector, cPanel "pop before smtp") and your server's IP is not allowlisted or changed.
Fix: Add the current public IP to the relay allowlist, or switch to SMTP AUTH. - Your own Postfix/Exim is not configured to relay for the network or user (mynetworks / relay_domains).
Fix: On your MTA, allow the sending network or require SASL auth; do not open relay to the world.
How to confirm which one you have
Run the SMTP tester with authentication and a From on your verified domain; a 250 after MAIL FROM/RCPT TO confirms the relay accepts you.
Open the SMTP tester Check SPF / DKIM / DMARC
Still stuck? Use a relay that tells you why
QueenSMTP shows every message's exact server reply in the log, verifies your domain's SPF and DKIM before you send, and is not subject to mailbox-provider caps. $5/year plus $0.10 per 1,000 emails; 100 a day free to test.
Try it freeRelated errors
Questions about 550
Same policy, different servers: 550 5.7.1 is the common Postfix/Exchange wording, 553 (Zoho, some Exim) refers to the sender address specifically. Both mean "not authorised to relay this".
Receiving only needs the server to accept mail for its domains; sending needs it to relay outward, which requires authentication or an allowlisted IP.
Related Guides
Continue learning with these related articles