What the bounce says
Exact wording as it appears in the rejection or NDR. Placeholders such as x.x.x.x and example.com stand for your own address and domain.
550 5.7.1 Unable to relay 550 5.7.1 Client does not have permissions to send as this sender 550 5.7.1 RESOLVER.RST.AuthRequired; authentication required 550 5.7.1 Service unavailable, Client host blocked using Spamhaus
5.7.1 is Exchange’s catch-all access-denied code, and the sentence after it is what matters. "Unable to relay" means the server would have had to forward the message to a domain it does not host and the client had not earned the right to ask. "Client does not have permissions to send as this sender" is a permissions problem on a mailbox. "RESOLVER.RST.AuthRequired" is a recipient that only accepts authenticated senders.
Most common causes
- An application or device is relaying through Exchange without a matching connector or authentication
- The sender address belongs to a mailbox the authenticated account has no Send-As permission for
- A receive connector or mail-flow rule restricts who may send to the recipient
- The connecting IP is on a block list consulted by the receiving organization
What to verify next
- Read the text after 5.7.1 — RESOLVER.RST.AuthRequired, Unable to relay, and Client does not have permissions are different problems
- Identify the exact endpoint, port and authentication the client uses
- Check Send-As and Send-on-Behalf permissions for the sender address
- Confirm whether the recipient organization has a rule restricting senders
Relay versus permission versus recipient restriction
Unable to relay appears when a device or application points at an Exchange server for a recipient outside the accepted domains, without authentication and without a receive connector that trusts its address. The server is protecting itself from being used as an open relay.
Send-as errors appear when an authenticated account uses a From address it is not entitled to — a shared mailbox, a colleague, a group. AuthRequired appears when the recipient object requires authenticated senders and the message arrived anonymously, typically from an external system or a relay.
- Unable to relay: connector or authentication is missing for the client.
- Send-as denied: mailbox permissions.
- AuthRequired: recipient-side sender restriction.
Confirm the path the client uses
Capture the SMTP session or read the application’s configuration: endpoint, port, whether it authenticates, and the address it presents in MAIL FROM. For relay, the fix is either SMTP AUTH with a licensed account on the client-submission endpoint, or a connector that trusts the client’s public IP or certificate.
For send-as failures, grant Send-As or Send-on-Behalf on the mailbox, or change the application to send from an address it owns. For AuthRequired, either authenticate the sending path or relax the recipient’s restriction.
The Spamhaus variant is different
When 5.7.1 continues with "Client host blocked using Spamhaus", the rejecting organization is consulting a public blocklist and the connecting IP is on it. That is an IP reputation problem for the sender, not a configuration problem at the recipient, and it is solved by fixing the cause of the listing and requesting removal.
Read the whole rejection before changing anything; the same numeric code covers all four cases.
Best diagnostic path
Mail Failure Doctor
Classify the complete rejection and preserve provider-specific diagnostic context.
Open analysis → Live analysisEmail Dependency Discovery
Map applications and devices that depend on a relay or submission path before changing it.
Open analysis → Live analysisEmail Infrastructure Digital Twin
Map the domain’s public mail infrastructure and provider relationships before remediation.
Open analysis →Known limits
- Exchange reuses 5.7.1 for many conditions; only the trailing text distinguishes them.
- Connector and permission configuration is visible only to the tenant administrator.
Common questions
Should I open relay for the device?
No. Register the device’s IP on an inbound connector, or have it authenticate. Open relay gets the server blocklisted quickly.
The account is licensed but still cannot send as the alias.
Aliases are not automatically sendable. Grant Send-As on the mailbox, or send from the primary address.
Why does the same client work to some recipients?
Direct send to your own tenant’s mailboxes is allowed anonymously; relay to external recipients is not.
Why the exact message matters
The same status family can be triggered by different conditions, and providers frequently add diagnostic text that narrows the issue. Use the complete rejection text rather than treating the numeric code as a complete diagnosis.
Provider reference
For the provider-defined meaning and current requirements, review Microsoft: Fix email delivery issues for error code 5.7.1.