564 Sender Not Authorized in Microsoft 365

What Causes the 564 Sender Not Authorized Error in Microsoft 365?

You send a message from your company email, only to get a bounce back with a 564 sender not authorized error from a Microsoft 365 recipient. No fancy jargon. No third-party tool. Just a plain rejection from a server that should know better.

This isn't about bad spelling or a typo. The 564 error surfaces when Microsoft 365’s mail server checks if your sending domain or IP is allowed to send on behalf of the recipient’s domain—and finds it isn’t. It’s like showing up at a gated office building with a visitor badge that doesn’t match your name or the company’s access list.

You’ll learn exactly why this happens—why even legitimate emails fail—what’s broken in your setup (SPF, DKIM, DMARC), and how to fix it using real, actionable steps. This matters because without fixing it, your outbound messages won’t reach inboxes, even if they’re perfectly written and targeted.

Key takeaways

The 564 error occurs when Microsoft 365 rejects an email due to missing or incorrect sender authorization records (SPF, DKIM, DMARC).
Most cases stem from misconfigured SPF records that don’t include third-party email services used to send mail.
Even internally sent emails can trigger the error if the sending domain isn’t explicitly authorized in the recipient’s recipient policy or tenant settings.

How Does Microsoft 365 Validate Sender Authorization?

Microsoft 365 checks sender authorization through three core DNS-based protocols: SPF, DKIM, and DMARC. It verifies that your sending IP is listed in your domain’s SPF record, confirms the message hasn’t been tampered with using DKIM signatures, and enforces DMARC policies to decide whether to accept, quarantine, or reject incoming emails. This process prevents spoofing and protects inbox integrity.

Check SPF records in DNS Microsoft 365 looks up your domain’s SPF record and validates whether the sending IP address is explicitly allowed. If the IP isn’t listed, the message fails SPF and may be rejected. You can test SPF validity with tools like MxToolbox.
Validate DKIM signatures It retrieves the public DKIM key from your DNS and uses it to verify the digital signature attached to the message. A mismatch or missing signature means the message was altered or not signed by an authorized sender—common reasons for the 564 error.
Apply DMARC policy If SPF or DKIM fails, Microsoft 365 consults your DMARC record. Policies here dictate: reject (p=reject), quarantine (p=quarantine), or monitor (p=none). A strict p=reject policy means failing messages are blocked outright.

Why This Matters for Your Email Deliverability

Failures at any step trigger a 564 error in logs: "Sender not authorized." That’s not a bug—it’s Microsoft enforcing sender authorization rules. Even if your messages are legitimate, misconfigurations in SPF, DKIM, or DMARC will cause rejection.

Common causes include outdated SPF records (exceeding the 10-include limit), missing DKIM signatures, or overly strict DMARC policies. These aren’t just technical details—they’re gatekeepers to inbox placement. A single misconfigured policy can block all outbound emails from your domain.

Use bulk email list cleaning to verify that your sender domain’s reputation is solid, and ensure your sending infrastructure aligns with current standards. For real-time validation of sender setups, integrate our API to check domain and email validity before sending.

How to Diagnose the 564 Error in Your Email Flow

The 564 sender not authorized error in Microsoft 365 typically means the sender's domain failed SPF or DKIM validation, or the envelope sender doesn’t match the sending domain. Let's walk through the diagnostics step by step to isolate and fix it.

Check the full SMTP error response from the receiving server. The 564 code is always preceded by a detailed message—capture the exact error text, including the envelope sender (Return-Path) and the domain being tested. This helps confirm whether the issue is with SPF, DKIM, or a misconfigured sender domain.
Test across multiple domains instead of just one. If the 564 error only appears for @outlook.com or @live.com addresses, it’s likely related to Microsoft's stricter enforcement of authentication policies. Compare results with non-Microsoft domains—this helps isolate whether the problem is sender-specific or systemic.
Verify that the envelope sender (Return-Path) used in the SMTP transaction matches the domain in your SPF record. A mismatch here—like sending from [email protected] but using yourcompany.com in SPF—triggers this error. Use tools like MXToolbox to validate SPF records in real time.
Ensure your DKIM signature is properly set up with the correct selector and domain alignment. Microsoft requires DKIM to align with the From domain, and a misaligned or missing signature can result in a 564. You can verify DKIM with RFC 6376 as a reference.
Check your sending server’s configuration to ensure it’s not using a shared IP or a domain that’s on a blocklist. A poor sender reputation, especially with no prior sending history, increases the chance of rejection.
Use real-time email verification before sending to catch invalid or improperly configured addresses. Even if an address is syntactically valid, it may fail during delivery due to missing or misaligned authentication. Verify your list in real time to spot these issues before they affect your deliverability.

When the issue is widespread

If you're hitting 564 errors across multiple domains, not just Outlook, the root cause is likely in your outbound email infrastructure. Review your outbound mail server’s configuration, ensure your SPF record includes all authorized sending domains and IPs, and confirm that your DKIM signing domain is consistent. Microsoft enforces these policies strictly, and misalignment at any layer can result in the 564 error.

How to prevent future issues

Regularly audit your email authentication setup. Use trusted tools to validate SPF, DKIM, and DMARC records. Clean your email list in bulk to remove addresses that could trigger delivery problems—even if they’re valid, poor sender reputation from misused addresses can hurt your overall domain score.

Why Invalid or Poorly Verified Email Addresses Trigger Send Failures

When you send emails to addresses that don’t exist, are set up as catch-alls, or come from disposable domains, Microsoft 365’s SMTP server promptly rejects them with a 564 "sender not authorized" error. These failures aren’t just cosmetic—they break deliverability chains and can harm your sender reputation over time, especially at scale.

Sending to Invalid or Disposable Addresses Causes Instant Rejection

Microsoft 365 enforces strict mail routing policies. Sending to an address on a domain with a catch-all policy or a temporary disposable email service often results in immediate SMTP rejection. The server responds with error 564 because the destination doesn't validate as a unique, properly configured mailbox.

For example, a catch-all address accepts all inbound mail regardless of validity, which spammers exploit. Microsoft detects this pattern and blocks such deliveries to avoid becoming a relay for abuse. Similarly, disposable domains are frequently tied to short-lived accounts, making them high-risk for spam propagation.

Even a single bounce from a malformed or unverifiable address can signal poor list hygiene, especially when repeated across a large campaign. This is a red flag in deliverability scoring, where consistent failure rates contribute to IP or domain blacklisting.

Deliverability Risk Grows with Poor List Quality

High volumes of invalid or poorly verified addresses don’t just cause bounces—they degrade your sender reputation. ISPs (including Microsoft) monitor sending patterns: a sudden spike in non-deliverable attempts indicates either outdated lists or a potential spam source.

Even if only one address fails with a 564 error, repeated across thousands of emails, it triggers automated systems that assess your domain's trustworthiness. A single bad address might not break things alone—but the cumulative signal does.

According to RFC 5321, proper mail delivery depends on the existence of a valid recipient at the destination. When senders fail to verify addresses before sending, they violate this foundation. Maintaining accurate, verified data is not optional—it’s how you prove you're a legitimate sender.

Let’s be clear: catching invalid addresses before sending is a technical necessity, not just a best practice. The cost of not doing it—is a damaged reputation, lost engagement, and fewer emails hitting inboxes.

Using a reliable verification tool like bulk email list cleaning helps identify and remove addresses that won’t deliver—before they trigger 564 errors or degrade your sender reputation.

Real-World Impact: What Happens When You Ignore the 564 Error

If your email system returns a 564 sender not authorized error when sending to Microsoft 365 domains, your messages won’t reach inboxes—meaning missed sales, delayed customer support, and frustrated users. This error signals a configuration issue with your domain’s authentication, and ignoring it means your outbound mail is treated as untrusted by Microsoft’s spam filters. Over time, repeated attempts with failed authentication harm your sender reputation, reducing deliverability even for valid recipients across other providers.

Mail That Never Arrives

Let’s be clear: if a recipient uses Outlook, Teams, or another Microsoft 365 service, your message will be rejected at the SMTP level when the 564 error appears. This isn’t a temporary filter—it’s a hard rejection. You might think the email was sent, but it never leaves your mail server’s queue. That means no confirmation of delivery, no open tracking, and no response—especially when you’re sending time-sensitive updates, onboarding messages, or renewal reminders. The result? Lost conversions and frustrated customers.

Reputation Damage Builds Over Time

Each failed delivery from your domain or IP address contributes to Microsoft’s internal abuse scoring. Even if only a small percentage of addresses are invalid, repeated 564 errors suggest poor sending hygiene. Microsoft’s anti-abuse systems track this behavior across time, and a pattern of failures can trigger IP or domain-level blocks. You’ll find your mail blocked not just by Microsoft, but also by other providers that monitor reputational data from sources like Spamhaus or The Anti-Abuse Organization. Once your domain is flagged, recovery can take days or weeks—even if you fix the root issue.

What’s worse, this reputation damage doesn’t stop with Microsoft 365 users. ISPs and email providers use shared reputation systems. A single poorly authenticated send can reduce your chances of landing in any inbox for weeks. Even if you later fix SPF/DKIM/DMARC, the damage lingers.

How to Prevent 564 Errors Before Sending

Stop 564 "sender not authorized" errors by validating every address before sending, filtering out invalid, catch-all, or role-based emails, and ensuring your domain’s email authentication (SPF, DKIM, DMARC) is properly configured. Let’s break down what you can do today.

Pre-send verification is non-negotiable

Run every email address through a real-time verification API or bulk list check before adding it to a campaign. This catches syntax errors, invalid domains, and non-existent users early.
Use a tool with proven accuracy—like Email List Validation, which achieves 98.9% verification accuracy—to filter out addresses that are likely to bounce or trigger authentication failures.
Flag and remove any role-based addresses (e.g. admin@, support@, sales@) as they’re often catch-alls or not monitored, and sending to them increases the risk of being flagged as spam.
Check for disposable email domains (e.g. mailinator.com, temp-mail.org) that don’t support legitimate replies. These are commonly used for fake sign-ups and hurt deliverability.

Authenticate your sending domain

Don’t send high-volume emails from domains that lack proper SPF, DKIM, and DMARC records. These are industry-standard email authentication protocols that prevent spoofing and improve inbox placement.
Verify SPF records are correctly configured to list only authorized sending IPs. Misconfigured SPF can lead to 564 errors even when the sender is legitimate.
Check DKIM signatures on outgoing messages—servers like Microsoft 365 validate them in real time. A missing or malformed DKIM signature will block delivery.
Use DMARC policies to monitor and enforce authentication. Without a DMARC record, your emails risk being flagged or rejected, especially by Microsoft 365.

According to an RFC 7208 specification, DMARC is designed to prevent email spoofing by providing a way for domain owners to specify which servers are allowed to send on their behalf. This is foundational to email trust.

Even if your list is clean, unauthenticated domains will fail in Microsoft 365 due to sender reputation and authentication checks. Prevent 564 errors not just by cleaning emails, but by proving your domain is authorized to send.

For a full validation workflow, try our real-time verification API or bulk email list cleaning to process high volumes with confidence and ensure send readiness.

Understanding Email Verification Verdicts and Their Impact

You need to understand email verification verdicts—valid, invalid, catch-all, risky—to avoid bounces like the 564 sender not authorized error in Microsoft 365. Each verdict reveals a different delivery risk: valid addresses are safe to send to; invalid ones will bounce; catch-alls accept mail you shouldn’t send to; and risky addresses harm your sender reputation. Letting any of these through wastes sends and hurts inbox placement.

What Each Verdict Means in Practice

Each result from a high-accuracy email verifier is more than a label—it’s a signal. Use it to make decisions, not guesswork.

Verdict	Meaning	Delivery Risk	Impact on Sender Reputation
Valid	The email address exists, has a mailbox, and accepts inbound mail. The domain has proper DNS records (MX, SPF, DKIM), and the address is routable.	Low	Negligible. Safe to send.
Invalid	The address does not exist, is permanently blocked, or is known to be inactive. It may have been deleted or never created.	High	High—each invalid send counts as a hard bounce and harms your sender reputation. Microsoft 365 flags repeated invalid sends.
Catch-all	The domain accepts all incoming mail, even to non-existent addresses. No validation occurs at the server level.	Very High	Severe—sending to catch-alls generates bounces you can’t control, which Microsoft 365 penalizes as spam-like behavior.
Risky	The address is disposable, role-based (e.g. admin@, sales@), or from a domain with low deliverability (e.g. temp email providers). Often temporary or shared.	Medium to High	Medium—low engagement, high unsubscribe or spam complaints hurt your reputation over time, even if delivery succeeds initially.

Microsoft 365 enforces SPF and DKIM checks, so sending from a misconfigured or unauthorized domain triggers the 564 error. If your list includes catch-all or disposable addresses, you’re more likely to hit this error—even if the domain itself appears valid.

Let’s be clear: no verification tool is perfect, but accuracy above 98%—like Email List Validation’s—means fewer surprises. A real-time API or bulk tool can pre-screen your list before every send, cutting bounce rates and protecting your domain reputation. Clean your list upfront to avoid these issues entirely.

For deeper insight, test inbox placement with tools that mimic real email clients and providers. Verify how your messages land in real inboxes, not just servers. The difference matters when you’re trying to reach real users.

Integrating Email List Validation with Microsoft 365 Workflows

You can prevent 564 sender not authorized errors in Microsoft 365 by validating email addresses before sending. Use the Email List Validation API to scrub lists in bulk or in real time. Automatically sync clean lists with Mailchimp, HubSpot, or Klaviyo to filter out invalid or risky addresses before campaigns launch. Test inbox placement to confirm deliverability to Outlook and other Microsoft 365 inboxes before sending.

Prevent 564 Errors with Proactive List Cleaning

Run bulk email verification on your list using Email List Validation’s bulk tool before pushing to Microsoft 365. This catches invalid, typosquatted, or nonexistent addresses that trigger 564 errors.
Integrate the real-time verification API directly into your sign-up or onboarding flow. Reject invalid addresses before they enter your database.
Use the API with your custom app or system to validate every new subscriber. This keeps sender reputation intact by avoiding failed delivery attempts.

Automate & Validate Before Every Send

Sync with Mailchimp, HubSpot, or Klaviyo via native integrations to auto-filter bad addresses before campaign sends. The tool checks for catch-all, disposable, and role-based emails that often cause authentication failures.
Check for common misconfigurations: ensure you’ve set up SPF, DKIM, and DMARC correctly. Tools like MXToolbox help verify alignment—validation alone won’t fix a broken setup.
Run inbox-placement tests with inbox placement simulation to check how your email lands in Outlook and Microsoft 365 inboxes. See if it hits spam, gets quarantined, or arrives cleanly.
Monitor sender reputation using third-party tools; poor reputation is a top cause of 564 errors. Even valid senders get blocked if reputation metrics degrade over time.

Deliverability isn’t just about sending—it’s about sending reliably. Validating your list before any Microsoft 365 mail flow avoids the 564 error and preserves inbox placement.

564 errors often stem from unverified or misconfigured senders. By validating emails before sending and testing deliverability, you reduce bounces, avoid blocklists, and maintain sender authentication integrity. This applies whether you're using Microsoft 365 directly or through SendGrid. Start with a free trial of Email List Validation to test your list’s quality and see how many 564 errors you could prevent. All purchased credits never expire—use them when you’re ready.

Pro Tip: Use Real-Time Verification for High-Risk Sending Domains

For custom domains in Microsoft 365, run real-time email verification before sending to catch SPF or DKIM issues early. This prevents the 564 sender not authorized error by validating identities instantly—before messages ever leave your server. You can test this with 100 free verifications from Email List Validation, zero risk.

Why Real-Time Checks Prevent 564 Errors

When you send from a custom domain in Microsoft 365, the server checks SPF, DKIM, and DMARC at delivery. If any of these fail—or if a sender identity doesn't match the domain’s published records—you get a 564 error. These aren’t just bounces; they harm your sender reputation and hurt inbox placement.

Using real-time verification during list preparation catches mismatches before they trigger delivery failures. For example, a user with a role email like [email protected] might be valid, but if your DMARC policy rejects unauthenticated senders, that message gets blocked. Real-time tools flag these early.

You can also detect disposable addresses, typos, or catch-all responses before they reach the mail server—and those are just as likely to generate 564 errors through misconfigured authentication.

How to Validate Domains Without Upfront Cost

Let’s be clear: you don’t need to pay to test this approach. Email List Validation offers 100 free verifications on sign-up. Use them to validate your first few thousand recipients, especially if your domain is new or has loose sender policies.

Integrate with your CRM, marketing platform, or email tool via the real-time verification API. Each address gets validated as it's added—no batch delays, no surprises. This is the most effective way to avoid sender policy errors in Microsoft 365.

For deeper testing, use the inbox placement feature to check how your messages are delivered across real Microsoft 365 inboxes. This shows you how sender reputation, authentication, and message content interact—proving whether your changes actually reduced 564 triggers.

For more background, Microsoft's official documentation on email delivery configuration emphasizes proper authentication setup. The industry-standard practices around SPF, DKIM, and DMARC are well-documented in RFC 7208 and RFC 7209.

Final Step: Monitor Bounce Rates and Sender Reputation

Fixing the 564 sender not authorized error is essential, but it’s not the end of the process. Bounce rates above 0.5% over time can still signal poor list hygiene to inbox providers, damaging long-term deliverability.

Stay Ahead of Blocklists and Reputation Risks

Check your IP and domain against blocklists using tools like MxToolbox or Spamhaus. Even a single listing can reduce inbox placement, especially for bulk emails.

Monitor bounce rates weekly and address spikes immediately.
Use real-time verification to prevent future 564 errors and other deliverability issues.
Purchase credits in advance—your verification credits never expire, so you can maintain clean lists at scale.

Sources

Segmented email campaigns earn 14.31% higher open rates and 100.95% higher click rates than non-segmented campaigns. — Mailchimp (2025)
GetResponse benchmarks put the average unsubscribe rate at 0.15% and the average spam complaint rate below 0.01% of sends. — GetResponse Email Marketing Benchmarks (2024)

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does the 564 sender not authorized error mean in Microsoft 365?

It means Microsoft’s mail server rejected the message because the sending domain or IP isn’t authorized to send on behalf of the recipient’s domain. This is typically due to misconfigured SPF, DKIM, or DMARC policies.

Can a bad email list cause a 564 error?

Not directly. But sending to catch-all, disposable, or invalid addresses increases the risk of abuse signals, which can trigger stricter rejection policies, including 564-like errors in high-volume or misconfigured flows.

How accurate is Email List Validation for catching invalid emails?

It delivers 98.9% accuracy through real-time SMTP checks, DNS validation, and pattern recognition across role, disposable, and catch-all domains.

Do I need to verify my own domain before sending to Microsoft 365 users?

Yes—ensure your domain has proper SPF, DKIM, and DMARC records published. Without them, your messages may fail authentication and trigger 564 errors.

What happens if I keep getting 564 errors despite fixing SPF and DKIM?

Check for role accounts (e.g. sales@, info@), catch-all domains, or disposable email providers that can appear as valid but cause delivery issues. Clean your list using a trusted verification tool.

Can I integrate Email List Validation with Mailchimp or HubSpot?

Yes—Email List Validation integrates with Mailchimp, HubSpot, Klaviyo, and SendGrid. Use the API or in-app assistant to verify lists before campaign sends.

How many free verifications come with Email List Validation?

You get 100 free verifications to start, with no expiration on purchased credits. Use them to test your list hygiene process.

Is the 564 error fixable after the email is sent?

No—it’s a rejection at the SMTP level. Once triggered, the message is discarded. Prevention—through verified lists and proper authentication—is the only effective solution.

Why are catch-all email addresses a delivery risk?

They accept all messages, including invalid ones. Sending to catch-all addresses creates bounce loops, increases spam score, and signals poor list hygiene to receiving servers.

How often should I verify my email list?

At least once every 3 months for active lists, and before each major campaign. Use a tool like Email List Validation to maintain high send quality and prevent delivery blocks.

Can disposable email domains trigger a 564 error?

Not directly. But they’re often hosted on IP ranges with poor reputation. Sending to them can hurt sender reputation, indirectly increasing the risk of rejection for legitimate addresses.

Does Email List Validation support bulk list uploads?

Yes—Email List Validation offers bulk list verification, allowing you to import and clean thousands of email addresses at once.