What the bounce says
Exact wording as it appears in the rejection or NDR. Placeholders such as x.x.x.x and example.com stand for your own address and domain.
550 5.7.133 RESOLVER.RST.SenderNotAuthenticatedForGroup; authentication required; Delivery restriction check failed because the sender was not authenticated when sending to this group
Groups can require that senders be authenticated members of the organization. When mail arrives for such a group from an external address or an anonymous relay, Exchange rejects it with this code and names the restriction in the text.
Most common causes
- The group is configured to accept messages from authenticated senders only
- An external sender or an application relaying anonymously tried to mail the group
- The internal sender’s message was routed through an external path and lost authentication
What to verify next
- Check the group’s "require sender authentication" setting
- If external senders are intended, disable the requirement or add them to the allowed list
- For applications, use an authenticated submission path
- Confirm internal mail does not leave and re-enter the tenant
The setting behind it
Distribution groups and Microsoft 365 groups have an option to require sender authentication. It is on by default for most group types created in the admin center, which is why newly created groups often reject external mail unexpectedly.
Internal senders can also trip it when their mail leaves the tenant and comes back — through a forwarding service, a ticketing system, or a mailing list — and arrives unauthenticated.
- Require-sender-authentication is on by default.
- External senders and anonymous relays are affected.
- Internal mail routed externally loses authentication.
Decide who should reach the group
If the group is meant to receive external mail — support@, sales@ — turn the requirement off, or keep it on and add specific external senders to the accepted list. If it is internal-only, the rejection is correct and the sender should use a different address.
Applications and devices
Systems relaying anonymously through a connector count as unauthenticated. Either allow their sending address explicitly on the group, or route them through an authenticated submission path.
Best diagnostic path
Mail Failure Doctor
Classify the complete rejection and preserve provider-specific diagnostic context.
Open analysis → Live analysisEmail Infrastructure Digital Twin
Map the domain’s public mail infrastructure and provider relationships before remediation.
Open analysis →Known limits
- Group settings are visible only to the recipient tenant.
- Related codes 5.7.134 and 5.7.135 describe neighbouring restrictions.
Common questions
The sender is an employee.
Their message probably arrived through an external path. Check whether it was forwarded or relayed outside the tenant.
Where is the setting?
In the group’s delivery management settings in the Exchange or Microsoft 365 admin center.
Is this a spam filter?
No. It is a group membership and authentication restriction.
Why the exact message matters
The same status family can be triggered by different conditions, and providers frequently add diagnostic text that narrows the issue. Use the complete rejection text rather than treating the numeric code as a complete diagnosis.
Provider reference
For the provider-defined meaning and current requirements, review Microsoft Exchange Online NDR reference.