550 5.7.509 error: failed DMARC (Microsoft)
Microsoft's 550 5.7.509 means your From domain failed DMARC and its policy is reject, so Microsoft refused the message. Fix SPF or DKIM alignment.
What 550 5.7.509 means
550 5.7.509 Access denied, sending domain [domain] does not pass DMARC verification and has a DMARC policy of reject.The domain in your From address failed DMARC, and that domain's policy (p=reject) tells receivers to refuse what fails.
List problem or sender problem?
Sender problem. It's your From domain's authentication, and your own DMARC policy told Microsoft to refuse it. It's a permanent failure: the server won't accept this message if you send it again unchanged.
How to fix 550 5.7.509
- Make SPF or DKIM pass for the same domain as your From address. That's what DMARC alignment means.
- Check that every service sending as your domain is in its SPF record and signs with its DKIM key.
- Send a test and read the headers: you want dmarc=pass before resuming.
In SendingOS, 550 5.7.509 shows on the conversation with its reason and code. If bounces like this pile up on one domain, a domain health rule can pause that domain's inboxes before the whole campaign suffers.
Not sure whether a spike in bounces is the list or the domain? Read High email bounce rate? Burned domain or bad list.
Related codes
Sources: Microsoft: NDRs in Exchange Online
Questions
Why does my own DMARC policy block my mail?
p=reject tells receivers to refuse anything that fails DMARC. If a sending service isn't set up in SPF or DKIM for your domain, its mail fails, and Microsoft does exactly what your policy says.