Credentials Microsoft Certified Trainer (MCT) 2026Microsoft Innovative Educator Expert 2025–2026Microsoft Elevate Educator Expert 2026–2027ISC2 Certified Information Systems Security Professional (CISSP)Microsoft 365 Certified: Enterprise Administrator Expert (MS-102)Microsoft Certified: Azure Solutions Architect Expert (AZ-305)PMI Project Management Professional (PMP) 28 certifications · see all Verify on Credly
Omer EltayebMicrosoft 365
LinkedIn
  1. Home
  2. Articles
  3. Exchange Online
Exchange OnlineTroubleshooting

NDR 550 5.7.1 Delivery not authorized, message refused: fixing it in Exchange Online

What 5.7.1 Delivery not authorized means in Exchange Online, how to tell a group restriction from a mail flow rule, and the settings and cmdlets that fix each cause.

Omer Eltayeb 4 min read Checked against Microsoft Learn

A sender writes to one of your groups or shared mailboxes and gets a bounce that says the delivery wasn't authorized. Exchange Online is doing what it was told: something in your configuration doesn't allow that sender to reach that recipient. In this post I'll show how to read the NDR to find which restriction fired, fix it with the right setting or cmdlet, and confirm delivery with message trace.

Errors this guide fixes

  • Delivery not authorized, message refusedNDR
  • TRANSPORT.RULES.RejectMessage; the message was rejected by organization policyNDR (diagnostic information)
  • 550 5.7.133 RESOLVER.RST.SenderNotAuthenticatedForGroup; authentication requiredNDR / message trace
  • 550 5.7.1 RESOLVER.RST.AuthRequired; authentication required [Stage: CreateMessage]NDR (diagnostic information)
  • 5.7.124 Sender not in allowed-senders listNDR
  • 5.7.134 Sender was not authenticated for mailboxNDR
Jump to the fix Browse the Microsoft 365 error library
How this guide is organized: Symptoms → Why it happens → How to fix it → Verify the fix → Tell it apart from other 5.7.x bounces → Prevent it next timeFlow diagram of the article's sections in reading order: 1. Symptoms. 2. Why it happens. 3. How to fix it. 4. Verify the fix. 5. Tell it apart from other 5.7.x bounces. 6. Prevent it next time. Toolbox: Recipients › Groups, RequireSenderAuthenticationEnabled, RESOLVER.RST.AuthRequired, AcceptMessagesOnlyFromSendersOrMembers, RejectMessagesFromSendersOrMembers.1Symptoms2Why it happens3How to fix it4Verify the fix5Tell it apart from other 5.7.xbounces6Prevent it next timeTOOLBOXRecipients › GroupsRequireSenderAuthenticationEnabledRESOLVER.RST.AuthRequiredAcceptMessagesOnlyFromSendersOrMe…RejectMessagesFromSendersOrMembersHow this guide is organized: Symptoms → Why it happens → How to fix it → Verify the fix → Tell it apart from other 5.7.x bounces → Prevent it next timeFlow diagram of the article's sections in reading order: 1. Symptoms. 2. Why it happens. 3. How to fix it. 4. Verify the fix. 5. Tell it apart from other 5.7.x bounces. 6. Prevent it next time. Toolbox: Recipients › Groups, RequireSenderAuthenticationEnabled, RESOLVER.RST.AuthRequired, AcceptMessagesOnlyFromSendersOrMembers, RejectMessagesFromSendersOrMembers.1Symptoms2Why it happens3How to fix it4Verify the fix5Tell it apart from other 5.7.x bounces6Prevent it next timeTOOLBOXRecipients › GroupsRequireSenderAuthenticationEnabledRESOLVER.RST.AuthRequiredAcceptMessagesOnlyFromSendersOrMembersRejectMessagesFromSendersOrMembers
At a glance: how this guide is organized · 6 sections · 5 key tools

Symptoms#

The sender's non-delivery report (NDR) carries a 5.7.x code. Microsoft's 5.7.1 guidance applies to the whole 5.7.0 to 5.7.999 range, and the text after the code tells you which control fired. These are the lines you are most likely to see:

Text
Delivery not authorized, message refused
TRANSPORT.RULES.RejectMessage; the message was rejected by organization policy
550 5.7.133 RESOLVER.RST.SenderNotAuthenticatedForGroup; authentication required; Delivery restriction check failed because the sender was not authenticated when sending to this group
550 5.7.1 RESOLVER.RST.AuthRequired; authentication required [Stage: CreateMessage]
  • Delivery not authorized, message refused is the default text of a mail flow rule that rejects with an enhanced status code. Admins report the diagnostic line then contains TRANSPORT.RULES.RejectMessage.
  • Microsoft's NDR reference lists specific codes for sender restrictions: 5.7.12 Sender was not authenticated by organization, 5.7.124 Sender not in allowed-senders list, 5.7.133 for groups, 5.7.134 Sender was not authenticated for mailbox, 5.7.136 for mail users and 5.7.13 or 5.7.135 for public folders.
  • For a mail-enabled public folder, an external sender gets the RESOLVER.RST.AuthRequired line shown above.
  • When the block sits on a nested group, the NDR names the restricted group, which isn't always the group the sender addressed.

Why it happens#

Finding which restriction refused the messageDid a Microsoft 365 server reject the message? if No: The recipient's organization must fix it (Only its admins can change that server.); if Yes: What do the NDR and the trace point to? if A mail flow rule: Add an exception or narrow the rule (Give each reject rule its own text and code.); if Moderation: Approve or let the sender bypass (Groups over 5,000 members need approval.); if Sender restriction: Which code does the NDR show? if 5.7.124: Add the sender to the allowed list (External senders need a mail contact first.); if 5.7.12/133/134/136: Accept senders from outside (Only on the group or mailbox that needs it.)Did a Microsoft 365 serverreject the message?NOTEThe recipient'sorganizationmust fix itOnly its admins canchange that server.NoWhat do the NDR and the tracepoint to?FIXAdd an exceptionor narrow the ruleGive each reject ruleits own text andcode.A mail flow ruleFIXApprove or let thesender bypassGroups over 5,000members needapproval.ModerationWhich code does the NDRshow?FIXAdd the sender tothe allowed listExternal sendersneed a mail contactfirst.5.7.124FIXAccept sendersfrom outsideOnly on the group ormailbox that needsit.5.7.12/133/134/136Sender restrictionYesFinding which restriction refused the messageDid a Microsoft 365 server reject the message? if No: The recipient's organization must fix it (Only its admins can change that server.); if Yes: What do the NDR and the trace point to? if A mail flow rule: Add an exception or narrow the rule (Give each reject rule its own text and code.); if Moderation: Approve or let the sender bypass (Groups over 5,000 members need approval.); if Sender restriction: Which code does the NDR show? if 5.7.124: Add the sender to the allowed list (External senders need a mail contact first.); if 5.7.12/133/134/136: Accept senders from outside (Only on the group or mailbox that needs it.)Did a Microsoft 365 server reject themessage?NoNOTEThe recipient's organization must fix itOnly its admins can change that server.YesWhat do the NDR and the trace point to?A mail flow ruleFIXAdd an exception or narrow the ruleGive each reject rule its own text and code.ModerationFIXApprove or let the sender bypassGroups over 5,000 members need approval.Sender restrictionWhich code does the NDR show?5.7.124FIXAdd the sender to the allowed listExternal senders need a mail contact first.5.7.12/133/134/136FIXAccept senders from outsideOnly on the group or mailbox that needs it.
Figure 1 · Decision tree Finding which restriction refused the message. Read the NDR's admin section and the message trace detail, then follow the restriction that fired to the narrowest fix.
CauseSetting behind itTypical sign
Only listed senders may sendAcceptMessagesOnlyFromSendersOrMembers5.7.124 (groups)
Only internal (authenticated) senders may sendRequireSenderAuthenticationEnabled5.7.12, 5.7.133, 5.7.134, 5.7.136, AuthRequired
Sender explicitly blockedRejectMessagesFromSendersOrMembers5.7.x restriction NDR
Moderation rejected or not approvedModerationEnabled, ModeratedByRejection notice instead of delivery
Mail flow rule rejects the messageReject action on a ruleDelivery not authorized, message refused; 5.7.1 or 5.7.900-5.7.999

A few situations catch admins out. First, groups with more than 5,000 members automatically require moderator approval, and Microsoft's 5.7.124 article adds that senders must be members. Second, a colleague can count as "external": a message that leaves Exchange Online and comes back through an inbound connector, for example via a cloud signature service, can arrive unauthenticated and trip RequireSenderAuthenticationEnabled. Depending on the group's settings, even its owner may need to be on the allowed senders list.

How to fix it#

  1. Read the NDR and the trace. In Diagnostic information for administrators, note the full code and which server rejected the message: the remote server listed under the recipient, or the generating server if none is listed. If that isn't a Microsoft 365 server, the recipient's organization rejected the message, so only its admins can fix it. Then open the failed message in message trace: the detail shows the same reason, and a mail flow rule that acted on the message usually appears as its own event.
    PowerShell
    Connect-ExchangeOnline
Get-MessageTraceV2 -RecipientAddress sales@contoso.com -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) -Status Failed |
    Select-Object -First 1 | Get-MessageTraceDetailV2 | Format-List Date, Event, Detail
  2. Inspect the recipient's delivery restrictions.
    PowerShell
    Get-DistributionGroup -Identity sales@contoso.com | Format-List RequireSenderAuthenticationEnabled,
    AcceptMessagesOnlyFromSendersOrMembers, RejectMessagesFromSendersOrMembers, ModerationEnabled, ModeratedBy

Get-Mailbox -Identity info@contoso.com | Format-List RequireSenderAuthenticationEnabled,
    AcceptMessagesOnlyFromSendersOrMembers, RejectMessagesFromSendersOrMembers

Get-UnifiedGroup -Identity project@contoso.com | Format-List RequireSenderAuthenticationEnabled, AcceptMessagesOnlyFromSendersOrMembers
  3. Allow the sender with the narrowest change. To accept outside mail on a distribution group, set RequireSenderAuthenticationEnabled to $false. In the Exchange admin center, that's Recipients › Groups, the group's Settings tab, Edit delivery management and Allow messages from people inside and outside my organization. To allow one external sender on a restricted list, Microsoft notes that you must first create a mail contact (or mail user) for them:
    PowerShell
    # Accept senders from outside the organization
Set-DistributionGroup -Identity sales@contoso.com -RequireSenderAuthenticationEnabled $false

# Or allow one external sender on a restricted list
New-MailContact -Name "Partner Sales" -ExternalEmailAddress orders@fabrikam.com
Set-DistributionGroup -Identity sales@contoso.com -AcceptMessagesOnlyFromSendersOrMembers @{Add="orders@fabrikam.com"}

# Shared mailbox or Microsoft 365 group that must accept outside mail
Set-Mailbox -Identity info@contoso.com -RequireSenderAuthenticationEnabled $false
Set-UnifiedGroup -Identity project@contoso.com -RequireSenderAuthenticationEnabled $false

    The @{Add=...} syntax appends to the list. Assigning a plain value replaces everyone already on it.

  4. Moderated groups: approve the waiting message, add trusted senders to BypassModerationFromSendersOrMembers, or turn moderation off if it no longer serves a purpose. For groups over 5,000 members, add the sender to the group.
  5. Mail flow rules: find rules that reject, then add an exception or narrow the condition (rule design tips):
    PowerShell
    Get-TransportRule | Where-Object { $_.RejectMessageReasonText -or $_.RejectMessageEnhancedStatusCode } |
    Format-Table Name, State, Priority, RejectMessageEnhancedStatusCode, RejectMessageReasonText

Tip: give every reject rule its own reason text and a code from 5.7.900 to 5.7.999. The next NDR then tells you which rule fired without a trace.

Verify the fix#

Ask the original sender to send again, or test from an outside mailbox, then trace it:

PowerShell
Get-MessageTraceV2 -RecipientAddress sales@contoso.com -StartDate (Get-Date).AddHours(-1) -EndDate (Get-Date) |
    Format-Table Received, SenderAddress, Subject, Status
  • Expanded (groups) or Delivered (mailboxes): fixed.
  • Failed with the same code: the change hasn't applied yet, or a nested group or second rule also blocks. Check the restricted group named in the new NDR.
  • Moderated group: nothing reaches the members until a moderator approves the test message.

Tell it apart from other 5.7.x bounces#

  • 5.7.1 Unable to relay or 5.7.57 from an app or device: relay and SMTP AUTH (guide).
  • 5.4.1 Recipient address rejected: Access denied: the recipient isn't in the directory (guide).
  • 5.7.520: external forwarding blocked (guide).
  • 5.7.129 in hybrid: Microsoft links it to sending to a user whose on-premises account was disabled.

Prevent it next time#

  • Decide per group whether it accepts outside mail, and document it in the group's description.
  • Keep allowed-sender lists group-based so new staff inherit access.
  • When you add a signature service or gateway that re-routes internal mail, test sending to restricted groups first.

References#

TagsNDRDistribution groupsMail flow rulesModeration

Written and checked against current Microsoft Learn documentation. Test changes with a pilot group before rolling them out to everyone, and if an admin center path has moved since, search for the setting name instead.

Spotted a mistake, or did this fix work differently for you? Email me or message me on LinkedIn — corrections are credited in the article.

Written by

Omer Eltayeb

Intune Subject Matter Expert in Cairo, Egypt, former Microsoft Cloud Solutions Architect, Microsoft Certified Trainer and Microsoft Innovative Educator Expert (2024–26) and Microsoft Elevate Educator Expert (2026–27). I share practical, step-by-step guides, study plans, scripts and toolkits for Microsoft Intune, Configuration Manager, Microsoft Entra ID, Microsoft Defender, Exchange and Microsoft 365 with the community.

Microsoft Certified Trainer (MCT) 2026Microsoft Innovative Educator Expert 2025–2026Microsoft Elevate Educator Expert 2026–2027ISC2 Certified Information Systems Security Professional (CISSP)Microsoft 365 Certified: Enterprise Administrator Expert (MS-102)
Connect on LinkedIn My community contributions More about me
Keep reading

More Exchange Online articles

All Exchange Online articles