Recommended Free Tools
“550 relay not permitted” means the SMTP server has refused to forward your message. The server does not recognise your client as authorised to send to the recipient’s domain. In practice, the fix is usually to enable SMTP authentication, use the provider’s correct submission host and port, make the From address match the authenticated mailbox, or correct the server’s relay and DNS policy.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Work through the checks below in order. The wording may vary—550 5.7.1 Unable to relay, 550 5.7.1 Relaying denied, and 554 5.7.1: Relay access denied describe the same broad policy refusal, although the exact cause depends on where the message was rejected.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the SMTP 550 relay error means
SMTP servers do not automatically forward every message submitted to them. A receiving server normally accepts mail for domains it hosts. An outbound relay, meanwhile, may forward mail to outside domains, but only for clients it can identify and trust. Trust is usually established with SMTP AUTH credentials, a permitted source IP, an approved connector, or a combination of those controls.
The refusal occurs when your client reaches the point where it asks the server to deliver to a recipient outside the server’s own domains and the server cannot find a valid authorisation. In an SMTP conversation, that is commonly exposed after the RCPT TO command, when the server knows the destination domain and applies its relay policy.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
This is normally a policy decision, not a spam-reputation or blacklist verdict. A server can reject relay before it evaluates the message body, attachments, or the recipient’s mailbox. Correcting authentication, endpoint, sender identity, or relay permissions is therefore more useful than repeatedly retrying the same message.
Common forms of the error
| Message shown by the client or server | What it indicates |
|---|---|
550 relay not permitted |
The server will not relay the message for this client or sender. |
550 5.7.1 Unable to relay |
A policy refusal frequently seen with Exchange or Jira Server integrations. |
550 5.7.1 Relaying denied |
The server has denied forwarding to the requested destination. |
554 5.7.1: Relay access denied |
The same class of refusal returned with a different SMTP reply code. |
The enhanced status code 5.7.1 points to a security or policy condition, but it does not by itself identify whether the problem is a password, port, sender address, connector, or DNS rule. The rejection stage and the server log provide that detail.
Check these details before changing anything
Record the exact error, the application that generated it, and the server name and port it is using. A mail client, website, monitoring service, printer, Exchange server, and Jira installation can all use different SMTP settings on the same network.
- SMTP host: Confirm that the configured host is the provider’s outbound submission server, not an MX host used only to receive mail.
- Port and encryption: Note whether the connection uses port 587 with STARTTLS, port 465 with implicit TLS, or port 25.
- Authentication: Check whether SMTP authentication is enabled and which account is being used.
- Identity: Write down the authenticated username and the exact
Fromaddress, including aliases and letter case. - Recipient domain: Determine whether the destination is inside the organisation’s hosted domains or external.
- Scope: Test a second recipient domain if possible. A refusal only for one domain suggests a recipient-domain or sender-domain policy rather than a general connection failure.
- Timing: Note whether the error appears immediately, after a password prompt, after STARTTLS, or only when the message is sent.
A diagnostic workflow that isolates the cause
- Capture the complete SMTP response. Do not rely on a shortened pop-up such as “send failed.” Open the application’s delivery log, mail queue details, or server log and copy the line containing the reply code and enhanced status.
- Identify the outbound endpoint. Compare the host name with the mail provider’s documented SMTP submission host. A host that accepts inbound mail for a domain is not automatically authorised to relay outbound mail.
- Check the port and TLS mode. For client submission, start with port 587 and STARTTLS or port 465 with implicit TLS, as supported by the provider. Port 25 is generally intended for server-to-server SMTP and many relays do not permit authenticated client submission there.
- Verify SMTP AUTH. Ensure the client is set to authenticate on the outgoing server, not only on the incoming POP or IMAP server. Use the complete email address as the username unless the provider explicitly requires another format.
- Re-enter credentials. Remove a saved password and enter it again. Check for an expired password, account lock, multifactor-authentication requirement, or an application-specific password requirement imposed by the provider.
- Compare the sender identity. Temporarily set
Fromto the same mailbox used for SMTP AUTH. If that succeeds, the original alias or delegated address needs explicit send-as permission or provider-side approval. - Test an internal and an external recipient. A message to a hosted local domain may be accepted even when external relay is blocked. Conversely, a local-domain failure can indicate that the server or connector is not configured for that domain.
- Inspect the mail log at the rejection stage. Find whether the server rejected the connection, authentication,
MAIL FROM, orRCPT TO. The stage determines which setting to change. - Retest once after each change. Keep the host, port, encryption, username, sender, and recipient constant so that one variable changes at a time.
Fix 1: enable and verify SMTP authentication
Unauthenticated submission is the first setting to check. A server may allow a connection but refuse relay because the client never completed SMTP AUTH before issuing MAIL FROM and RCPT TO.
Mail clients and applications
- Open the account’s Outgoing server (SMTP) settings.
- Turn on Outgoing server requires authentication or the equivalent label.
- Select the option to use the same credentials as the incoming account, or enter the outbound account separately if your provider requires it.
- Use the full email address as the username, for example
[email protected], unless the provider documents a different login. - Save the settings, restart the application if it caches the connection, and send a new test message.
Do not confuse successful IMAP or POP authentication with successful SMTP authentication. Incoming and outgoing services can use different hosts, ports, credentials, and policies.
When a password is accepted but relay is still denied
Authentication proves who connected; it does not necessarily grant permission to use every sender address or deliver to every domain. If the server logs show successful AUTH followed by a 550 response at RCPT TO, move to the sender, recipient-domain, and relay-policy checks rather than repeatedly changing the password.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Fix 2: use the correct outbound host, port, and TLS mode
Using the wrong host is a common configuration error. An MX record identifies where a domain receives mail; it does not guarantee that the same host accepts authenticated submissions from applications. Replace a receiving-only or generic hostname with the outbound SMTP submission host specified for your account.
| Port | Typical use | Encryption expectation | What to verify |
|---|---|---|---|
587 |
Authenticated client submission | STARTTLS is normally negotiated after the initial connection. | The client must support STARTTLS and authenticate after TLS is established. |
465 |
Authenticated submission with implicit TLS | TLS starts immediately when the connection opens. | Select “SSL/TLS” or “implicit TLS,” not STARTTLS, if that is how the provider defines the port. |
25 |
Server-to-server SMTP and legacy relaying | May be plaintext or opportunistic STARTTLS, depending on policy. | Do not assume AUTH or external relay is enabled; many services reject client submission on this port. |
Port numbers are not interchangeable. Choosing STARTTLS on a port that expects implicit TLS, or implicit TLS on a plain connection, produces a TLS or connection error rather than a relay error; however, selecting port 25 when the provider expects authenticated submission can lead directly to a 550 5.7.1 refusal.
Fix 3: make the From address match the authenticated account
Many relays permit a user to send only as the mailbox that authenticated. An application that logs in as [email protected] but sends From: [email protected] can therefore be rejected even when the password is correct.
- Set the visible
Fromaddress to the exact authenticated mailbox. - Send a test message to an external address.
- If the test works, restore the desired alias and check whether the provider has a verified-alias, delegated-send, or send-as permission setting.
- For Exchange or Jira integrations, inspect the connector and mailbox permissions as well as the application’s sender field. An unrecognised sender address is a documented cause of “Unable to relay” responses in those environments.
Also check hidden sender fields. Some applications set an envelope sender or return-path separately from the visible From header. A server may apply relay policy to the envelope address, so changing only the display name or visible header may not solve the rejection.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fix 4: correct sender-domain and DNS authorisation
Sender authentication records do not replace SMTP AUTH, but they can determine whether a relay accepts a source. Ensure that SPF includes every server or service that sends mail for the domain. Publish DKIM for the signing service and configure DMARC to express how receivers should evaluate SPF and DKIM alignment.
- SPF: Verify that the public SPF record authorises the actual sending IP or service. Multiple SPF records are invalid; combine mechanisms into one record within the provider’s limits.
- DKIM: Confirm that the selector’s public key is published and that the sending system signs messages with the matching selector and domain.
- DMARC: Check that the visible or envelope sender aligns with the authenticated domain as required by the policy.
- Reverse DNS: For a self-hosted relay, confirm that the sending IP has appropriate reverse DNS and that forward and reverse names are consistent where the provider requires it.
- Blocklists: Check the sending IP against reputable blocklist services if the server log mentions reputation or IP denial. A pure “relay not permitted” response is usually an authorisation problem, but an IP policy can be part of the same decision.
DNS changes are cached. Verify the records from outside your network and allow for the published TTL before concluding that a corrected record has had no effect.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Fix 5: configure relay permissions on a server you operate
If you administer the SMTP server, the client may be correctly configured but absent from the server’s relay policy. The server must have a controlled way to trust the source: authenticated users, a narrowly defined IP range, a receive connector, or an approved service account. Do not solve the error by permitting unrestricted relay; an open relay can be abused to send large volumes of unsolicited mail and damage the domain’s reputation.
Postfix and Sendmail
Postfix and Sendmail expose different configuration models. In Postfix, administrators commonly review the networks considered trusted, the relay restrictions applied to unauthenticated destinations, and whether SASL authentication is enabled on the submission service. In Sendmail, administrators commonly review the access database and authentication-related options before rebuilding and reloading the configuration. The exact directives and syntax vary by release and distribution, so use the official documentation for the installed version rather than copying a rule intended for another system.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAfter changing a relay rule, reload the service, confirm that the intended submission listener is using the new configuration, and test from the same source IP and account that generated the original error. A rule applied to port 25 may not affect the separate submission listener on port 587.
Microsoft Exchange
In Exchange, check the receive connector that accepted the connection. Review its authentication mechanisms, the remote IP ranges assigned to it, and whether it permits relay to the recipient domain. Also verify that the mailbox or service account is allowed to submit as the address used in the message. Changes to a connector should be as narrow as possible: identify the application’s source, require authentication where feasible, and avoid granting relay to an entire untrusted network.
Jira Server and other application relays
For Jira Server or another application that submits through an organisational relay, verify both sides: the application’s SMTP host, port, TLS, credentials, and sender address, plus the relay’s connector rule for that application’s source. An application can report “550 5.7.1 Unable to relay” when the relay is reachable but has no rule allowing that source or sender. The application log and the relay’s SMTP log should be compared using the same timestamp.
Test the SMTP conversation directly
A direct protocol test can separate a client-interface problem from a server-policy problem. Run it only against a server you are authorised to test. Replace the host name with the outbound submission host and use a test account; do not paste a real password into a shared ticket or public log.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
openssl s_client -starttls smtp -connect smtp.example.com:587After the TLS handshake, issue the following SMTP commands, waiting for a response after each one:
EHLO test.example.com
AUTH LOGIN
MAIL FROM:<[email protected]>
RCPT TO:<[email protected]>The exact AUTH exchange depends on the mechanisms advertised by the server. The command above is a diagnostic outline, not a universal credential format. If the server does not advertise AUTH after STARTTLS, authentication may be disabled on that listener or the connection is reaching the wrong host or port.
- TLS fails before EHLO: Correct the encryption mode, hostname, certificate trust, or port.
- EHLO succeeds but AUTH is unavailable: Use the provider’s submission listener or enable the appropriate authentication policy on your server.
- AUTH fails: Check the username format, password, account status, and any application-password requirement.
- AUTH succeeds but
MAIL FROMorRCPT TOreceives 550: Check sender permissions, relay rules, recipient-domain policy, and source-IP authorisation. - Internal recipients work but external recipients fail: The server is probably not permitting outbound relay for this account or connector.
Use logs to find the exact rejection point
Client error messages often omit the useful part of the SMTP exchange. On a Unix-like mail server, inspect the configured mail log, commonly named /var/log/maillog or /var/log/mail.log. Exchange exposes SMTP protocol and transport logs through its server logging facilities. Application logs may record the host, port, TLS result, authenticated user, sender, recipient, and server response.
Search the log using the message timestamp, queue ID, or application connection ID. Look for:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- the listener or receive connector that accepted the connection;
- the source IP address;
- an AUTH success or failure;
- the envelope sender and recipient domain;
- the rule or connector that generated the 550 or 554 response.
Do not publish complete authentication transcripts. Redact passwords, access tokens, message content, and personal recipient addresses before sharing logs with an administrator or provider.
Common scenarios and the fastest remedy
A website suddenly stops sending after a password change
Update the SMTP credential stored by the website or background job, then verify that it still uses the submission host and port. If the account uses multifactor authentication, create the provider-approved application credential if required. Confirm that the website’s configured sender is an address the account may use.
A printer or scanner reports relay denied
Older devices often default to port 25, use a short username, or cannot negotiate modern TLS. Check whether the provider offers a device-specific relay, an internal authenticated relay, or a supported submission mode. If the device cannot meet the provider’s security requirements, place it behind a controlled internal relay rather than allowing the device direct, unrestricted external delivery.
Only one mailbox or alias fails
Compare the failing sender with a mailbox that works. A mismatch between the authenticated account and the alias, missing send-as permission, or a sender-domain rule is more likely than a network problem. Test with the primary mailbox address to confirm.
Only external recipients fail
Check the relay permission for the account or source IP and verify that the destination domain is not blocked by an organisational outbound policy. Successful delivery to a local mailbox does not prove that external relay is enabled.
The error appears after moving mail hosting
Replace old SMTP host names, credentials, certificates, and DNS authorisation records in every application. An MX change affects inbound routing but does not automatically update outbound SMTP settings. Inventory websites, scripts, printers, monitoring tools, and desktop clients so that one forgotten sender does not continue using the old relay.
Prevent the error from returning
- Document the approved SMTP host, port, TLS mode, username format, and sender addresses for each application.
- Use a separate service account for automated mail and grant it only the sender permissions it needs.
- Prefer authenticated submission on port 587 or the provider’s documented TLS submission service instead of unauthenticated port 25.
- Monitor password and certificate expiration for service accounts.
- Keep SPF, DKIM, and DMARC records aligned with the systems that actually send mail.
- Restrict IP-based relay permissions to fixed, trusted sources and review them when infrastructure changes.
- Retain enough SMTP and application logging to identify the rejection stage without storing credentials or message content.
- Test both an internal and an external recipient after changing a relay, connector, DNS record, password, or sender alias.
When to contact the mail provider or administrator
Escalate with the exact SMTP response, UTC timestamp, source IP, outbound host and port, authenticated username (but never the password), envelope sender, recipient domain, and the relevant log lines. Ask the administrator to confirm whether the account is allowed to relay externally, whether the sender address is approved, and which connector or policy rejected the message. This information lets them distinguish a credential problem from a deliberate relay restriction without asking you to weaken the server’s security.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
