There's an 78.3% chance your domain can be spoofed right now. Run DMARC Check

Generic SMTP

"Relay not permitted" / "Relay access denied" — who's refusing and why

550 relay not permitted

An SMTP server only accepts mail it has a reason to handle: mail for domains it hosts, or mail from senders who've authenticated to use it as their outbound server. "Relay not permitted" (also seen as "554 5.7.1 Relay access denied") means neither condition held — the server was asked to pass mail onward for a domain it doesn't host, from a client it doesn't trust. Open relays died decades ago; every properly configured server refuses this.

How to fix it

  1. 1

    Turn on SMTP authentication in the sending client

    The dominant cause. In your mail client or application's outgoing-server settings, enable "My outgoing server requires authentication" with the same credentials as incoming mail, and use the submission port 587 (or 465) rather than port 25 — many servers accept unauthenticated connections on 25 for inbound mail only, then refuse relay.

  2. 2

    Check you're using the right outgoing server

    This error commonly appears after switching email providers: the client still points at the old provider's SMTP server, which no longer recognizes you. The outgoing server must belong to whoever hosts your mailbox now.

  3. 3

    If bounces mention a domain you own: check your MX records

    When inbound mail to your domain bounces with relay denied, your MX records point at a server that doesn't consider itself responsible for your domain — a stale MX after a migration, or a mail server missing the domain in its accepted-domains list. Run the MX lookup and confirm each listed host actually hosts your mail.

  4. 4

    On networks that block port 25

    Some ISPs and cloud providers block or intercept port 25 entirely. Use port 587 with authentication — which is the correct configuration anyway — rather than fighting for port 25.

Meaning current as of 2026-07-25, cross-checked against the provider's own documentation. Providers do occasionally redefine codes — if this doesn't match what you're seeing, the source link is the authoritative reference.

Common questions

Why does the same account send fine from webmail but fail from my mail app?+

Webmail submits through the provider's internal path, which is pre-authenticated. Your mail app speaks SMTP directly, so it must present credentials — if authentication is off or pointed at the wrong server, only the app's sends fail with relay denied.

Is this related to SPF or DMARC?+

No — relay refusal happens at the SMTP session, before content or DNS-based authentication is evaluated. Fixing SPF won't help; the server is refusing to carry the message at all, not judging its authenticity.

Could someone be trying to use my server as a relay?+

If you run a mail server and see relay-denied entries in your logs for mail you didn't send, yes — that's the server correctly refusing third parties probing for an open relay. It's evidence the protection works, not a problem to fix.