5.7.520: External forwarding is not allowed (Microsoft 365)

At a glance

• Type: permanent failure (class 5, RFC 3463 §2). The sending server does not retry; sending the same message again fails the same way until the cause is fixed.
• Basic code: varies; the enhanced code is the part that identifies the problem.
• Enhanced code 5.7.520: not in the IANA registry; the group is security or policy status (RFC 3463 §3.8).
• Who uses it: Microsoft (Exchange Online): your organization does not allow external forwarding.

A 5.7.520 bounce from Microsoft 365 means a mailbox in your organization tried to forward mail automatically to an outside address, and your organization's policy blocks that. The original message was delivered to the mailbox; only the forwarded copy was stopped.

What it means

This is Microsoft's code, not one from the IANA registry. Microsoft's Exchange Online NDR reference describes it as an organization that does not allow external forwarding: Microsoft 365 detected automatic forwarding to an outside recipient, and the outbound policy blocked it.

Organizations block this on purpose. Automatic forwarding is one way mail leaves a company without anyone noticing, for example when an attacker who took over a mailbox adds a forwarding rule.

Common causes

• A user created an inbox rule that forwards or redirects mail to a personal address.
• Forwarding was set on the mailbox itself, in the user's mail settings or by an admin.
• An app or shared mailbox forwards to a partner, vendor or outside ticket system.
• A compromised account had a forwarding rule added. Check this before you allow anything.

How to fix it

If you are the user:

1. Remove the forwarding rule, or ask your admin whether forwarding to that address can be allowed.
2. To reach your mail from elsewhere, use the organization's apps or webmail instead of forwarding.

If you are the admin:

1. Find the mailbox and the rule or forwarding setting that triggered it.
2. Confirm the forwarding is wanted and that the account is not compromised. If you did not expect the rule, treat it as a security incident.
3. If it is wanted, allow it in the outbound spam filter policy for that user or group, and check the remote domain settings for the destination domain.
4. Keep the policy narrow: allow forwarding only for the people and destinations that need it.
5. Remember that forwarded mail can fail SPF at the destination; see 5.7.367.

Similar problems

A forwarding setup that sends mail back and forth between two systems ends as a loop, reported as 554 5.4.6. An outside sender refused by an internal-only group or mailbox gets 5.7.133.

What to do with the address

Nothing. The forwarding target address is not the issue, and the original message already reached the mailbox.

Related codes

• 5.7.367: Remote server says not permitted to relay (Microsoft 365)
• 554 5.4.6: A mail loop was detected
• 5.7.133: The group or mailbox takes no mail from outside (Microsoft 365)

See every bounce code in the dictionary.

Many bounces from addresses that do not exist can be avoided: check an address with our free email checker, or clean a whole list before you send.

How we wrote this: drafted by the email-validation.org team with the help of AI writing tools, from our product documentation and the sources linked in the text.