What 550 5.7.1 Means
Microsoft 365 (and Outlook.com) returns '550 5.7.1 Unable to relay' when you ask the server to deliver mail it can't (or won't) deliver. The two main causes: you sent mail to a domain that isn't hosted at the connected server, or you're trying to send outbound through Microsoft's relay without proper authentication.
Microsoft 365 and Office 365 tenants, Outlook.com, and Exchange Online. The exact wording is consistent across Microsoft's mail infrastructure.
You're sending to a domain not hosted at the server you connected to (most common: wrong MX target); OR you're trying to send outbound through Microsoft's SMTP relay without authentication; OR you're sending via an Exchange Online connector that's misconfigured.
How to Fix 550 5.7.1
- 1
Verify the recipient's MX record
Use the MX Lookup tool at coldrelay.com/tools/mx-lookup against the recipient domain to confirm where their mail actually goes. If your sending platform is hitting a stale MX, 'unable to relay' is the consistent response. Send to the canonical MX target.
- 2
If sending outbound through Microsoft relay — authenticate properly
Microsoft's SMTP relay (smtp.office365.com) requires authentication via OAuth2 or AUTH LOGIN with a service account that has 'Send As' permissions. Anonymous relay is disabled. Verify your sending platform is configured with the right service account credentials.
- 3
Check for stale Exchange connectors
If you're an admin and your tenant has custom outbound connectors (Exchange Admin → Mail Flow → Connectors), verify the connector configuration. Common issue: a 'Smart Host' set to a non-existent or unauthorized server. Connectors that route through unauthorized hosts trigger unable-to-relay.
- 4
Verify your sending IP is allowed in tenant restrictions
Microsoft 365 tenants can configure IP allowlists for outbound relay. If your sending platform's IPs aren't on the list, 'unable to relay' is returned regardless of credentials. Check Exchange Admin Center → Mail Flow → Connectors → outbound rules.
- 5
Consider whether you need Microsoft relay at all
Most cold email senders don't use Microsoft's outbound relay; they send directly from ColdRelay's dedicated mail servers. If you're going through Microsoft's relay only because your mailboxes are Microsoft 365, you can usually skip the relay and send directly via the mailbox's SMTP endpoint.
References
550 5.7.1 in the Cold Email Context
'Unable to relay' is a setup-time error for cold email — once your sending platform is configured correctly with the right SMTP host and credentials, it stops appearing. ColdRelay provisions each customer's mailboxes with a dedicated SMTP host (box.YOURDOMAIN.com) that doesn't route through Microsoft's general relay; your sending platform talks directly to your dedicated mail server. The 'unable to relay' scenario typically arises only if a customer tries to bypass the ColdRelay mail server and send through some other route — which is unnecessary and not supported.
Frequently Asked Questions
Why does Microsoft block anonymous relay?
Anonymous relay is a primary spam vehicle — open relays get abused within hours of discovery. Microsoft 365 (and modern Exchange) requires authentication for outbound relay by default, with strict per-tenant configuration for any unauthenticated bypass paths.
Can I send to non-Microsoft addresses through Microsoft's relay?
Yes, with proper authentication. Microsoft's relay accepts outbound to any domain when you authenticate as a tenant user. The 'unable to relay' specifically means you're either not authenticated or you're hitting a connector that's restricted.
Is this the same error as 5.7.1 spam policy?
Same code (5.7.1) but different cause and text. 'Unable to relay' is a routing/authentication issue. Spam policy is a content/reputation issue. The descriptive text after 5.7.1 is what distinguishes them.
Should I use Microsoft's smtp.office365.com for cold email?
If your mailboxes are in M365, sending through smtp.office365.com is fine — authenticate as the mailbox user. But ColdRelay's dedicated mail servers (separate from Microsoft's shared smtp.office365.com) generally give better deliverability for cold email because they're not on shared Microsoft infrastructure.