SMTP Relaying Denied: Complete Fix for Postfix, Exim, and Sendmail

• Common causes of 550 5.7.1
• How to fix 550 5.7.1, step by step
• Prevention going forward
• Frequently asked questions about 550 5.7.1
• Continue reading

550 5.7.1 <user@domain>: Relay access denied

Common causes of 550 5.7.1

1. SMTP authentication not enabled in your application. The single most common cause. Your mail client, transactional service, or custom code is trying to relay through an authenticated SMTP server without providing AUTH credentials. Modern relays never allow unauthenticated relay by default because open relays get instantly abused for spam. This affects everything from misconfigured smtplib scripts to legacy applications ported from environments that historically allowed open relay. The fix is always to enable SMTP AUTH and provide valid credentials in the connection.
2. Connecting to the wrong outbound SMTP server. Some setups mistakenly point their outbound SMTP at a MX server (used for receiving mail) or at a generic public relay. These servers reject relay attempts with 550 5.7.1 because they are not configured to accept your outbound traffic. Confirm you are connecting to the outbound submission server documented by your email provider. Public MX records are for INCOMING mail: they do not accept outbound relay from client applications even with valid credentials.
3. Sending IP not in the relay allowlist. For self-hosted Postfix, Exim, or Sendmail, unauthenticated relay is permitted only for IPs listed in mynetworks (Postfix) or the equivalent trusted-host configuration. If your application server is sending unauthenticated from a new IP that was never added to the trusted list, the relay rejects with 550 5.7.1. This surfaces after infrastructure moves, container restarts on new IPs, or firewall changes that shift outbound routing to a different source address.
4. Expired or rotated SMTP credentials. Passwords rotate on schedules. API keys expire. Service accounts get disabled during quarterly access reviews. Your application keeps sending with credentials it was configured with, gets 550 5.7.1 as the relay refuses the AUTH handshake, and your team spends an hour debugging routing before checking the credentials themselves. Always verify credentials before deeper investigation: a fresh authentication test takes seconds and eliminates the most common trivial cause.
5. Sending domain not in Accepted Domains (Exchange). For self-hosted Exchange or hybrid Microsoft 365 setups, mail can only be relayed for domains explicitly listed in Accepted Domains. If your organization added a new subdomain or acquired a new company domain without updating Exchange configuration, sends from that domain hit 550 5.7.1 or the closely related 550 5.7.54 (unable to relay in non-accepted domain). The fix is to add the domain to Accepted Domains via Exchange Admin Center or PowerShell before retrying.

How to fix 550 5.7.1, step by step

1. Enable SMTP authentication in your sending application. In most mail libraries (nodemailer, smtplib, PHPMailer, Mail::Sender), SMTP AUTH is a simple config flag: pass a username and password to the constructor and set secure to true for TLS. For custom code using raw sockets, implement the AUTH LOGIN or AUTH PLAIN exchange after EHLO. If you are unsure whether AUTH is happening, add SMTP debug logging temporarily and observe the wire: you should see AUTH commands before MAIL FROM. Missing AUTH commands are the smoking gun.
2. Use port 587 with STARTTLS as your submission port. Port 587 is the RFC 6409 designated submission port for authenticated SMTP. Configure your app to connect on 587, negotiate STARTTLS, then authenticate, then send. Port 465 with implicit TLS is a legacy alternative that some providers still support (Gmail Workspace, for instance). Port 25 is for server-to-server relay only and should never be used for authenticated submission from applications. Most modern ISPs also block outbound port 25 for residential and non-mail-server networks.
3. Verify your credentials against the relay server directly. Before touching your app code, prove the credentials work by connecting manually. Using openssl s_client -starttls smtp -connect smtp.example.com:587, or a tool like swaks, run the AUTH LOGIN handshake with your username and password. If the manual test also fails, the credentials are the problem: reset the password, generate a new API key, or check that the account is not disabled. If manual works but the app fails, your app config or library is misconfigured.
4. Add your sending IP to the relay allowlist (self-hosted only). For Postfix, add the IP to mynetworks in main.cf and reload postfix. For Exim, update hosts_allow_relay. For self-hosted Exchange, add the IP to the receive connector Remote Network Settings. After the change, reload the mail service and retry the send. Only allowlist IPs you fully control and trust: allowlisting shared or dynamic IPs turns your server into an open relay that will be abused for spam within hours of discovery.
5. Update the outbound server hostname if you migrated providers. Common configurations drift out of alignment after ESP changes or domain migrations. Confirm the outbound hostname in your app matches what your CURRENT provider documents, not tribal knowledge or an outdated wiki page. Providers occasionally deprecate old outbound hostnames without prominent warning. If your app has been sending for years without change, the hostname it uses might have been quietly retired and you are hitting a legacy endpoint that no longer accepts your credentials.
6. Consider switching to a dedicated SMTP relay service. For applications that need reliable outbound delivery without infrastructure management, dedicated services (SendGrid, Mailgun, Amazon SES, Postmark) handle relay configuration, authentication, port setup, and TLS entirely. You call their API or SMTP endpoint with an API key, they handle everything downstream. This eliminates the whole category of 550 5.7.1 relaying-denied errors caused by self-hosted misconfiguration, and typically costs less than the developer time spent maintaining your own relay.

Prevention going forward

Frequently asked questions about 550 5.7.1