SMTP 550 5.7.1: Relay access denied – causes & fix

The server rejects the message for policy reasons – usually because the sender is not authenticated and the server would have to relay mail to a domain it is not responsible for.

Common causes

• The mail client or application sends without SMTP AUTH.
• Mail is submitted on port 25 instead of submission port 587 (or 465) with login.
• The recipient domain is missing from virtual_mailbox_domains, mydestination or relay_domains.
• The application server's IP is not in mynetworks.
• The receiving server (e.g. an Exchange receive connector) rejects the sender or IP by policy.

How to check it

Show Postfix relay settings

postconf -n | grep -E 'mynetworks|relay_domains|smtpd_relay_restrictions|virtual_mailbox_domains'

Find rejected attempts and client IPs in the log

journalctl -u postfix --since '1 hour ago' | grep 'Relay access denied'

Test authenticated submission on port 587 (prompts for the password)

swaks --to [e-mail] --from [e-mail] --server mail.example.com --port 587 --tls --auth LOGIN --auth-user [e-mail]

What actually helps

1. Enable SMTP AUTH in the client and use port 587 with STARTTLS.
2. Add your domains to virtual_mailbox_domains or relay_domains, then run postfix reload.
3. Set clean relay rules: smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination.

FAQ

Does 550 5.7.1 always mean relay access denied?

No. 5.7.1 is a generic policy code. Microsoft 365, spam filters and sender restrictions use it too. The text after the code tells you what actually happened.

Can I just widen mynetworks?

Only for single trusted hosts. Something like 0.0.0.0/0 turns the server into an open relay that ends up on blocklists within hours.

---

Full page with every command and the German/Italian version: daniele-michelin.com/en/errors/smtp-550-5-7-1/

First published at daniele-michelin.com. The error lexicon covers HTTP, DNS, TLS, mail, database, PHP, nginx, systemd and Nextcloud, in German, English and Italian.