5.7.64: TenantAttribution: relay access denied (Microsoft 365)
At a glance
- Type: permanent failure (class 5, RFC 3463 §2). The sending server does not retry; sending the same message again fails the same way until the cause is fixed.
- Basic code: varies; the enhanced code is the part that identifies the problem.
- Enhanced code 5.7.64: not in the IANA registry; the group is security or policy status (RFC 3463 §3.8).
- Who uses it: Microsoft (Exchange Online): TenantAttribution; Relay Access Denied.
A 5.7.64 bounce from Microsoft 365 means mail from your own on-premises servers no longer matches the inbound connector set up for them. Microsoft 365 can no longer tell that this traffic belongs to your organization, so it refuses to relay it.
What it means
This is Microsoft's code, not one from the IANA registry. Microsoft's Exchange Online NDR reference names it TenantAttribution; Relay Access Denied.
When an organization sends mail from its own servers (a hybrid Exchange setup, an application server, a mail gateway) through Microsoft 365, an inbound connector tells the service how to recognize those servers: by their IP addresses or by the TLS certificate they present. "Tenant attribution" is that matching step. If the incoming connection matches no connector, Microsoft 365 treats it as an outsider asking to relay mail to other domains, and refuses.
Common causes
- The on-premises server or gateway moved to a new public IP address, and the connector still lists the old one.
- The TLS certificate the server presents was renewed or replaced, and its name no longer matches what the connector expects.
- A firewall or NAT change makes outbound mail leave from a different address.
- The connector was edited, disabled or deleted.
- A new server started sending through Microsoft 365 without being added to any connector.
How to fix it
- Find the sending server's public IP in the bounce, then check which certificate it presents when it connects.
- In the Exchange admin center, open the inbound connector for your on-premises organization.
- If the connector matches by IP, add the new address (and remove old ones you no longer use).
- If it matches by certificate, update the expected name to match the new certificate, or install a certificate whose name matches.
- Send a test message from the on-premises side, then let queued mail retry.
Similar errors
An app or device that connects to smtp.office365.com without signing in gives 5.7.57, not this code. A server that does not accept mail for the recipient's domain at all reports Relay Access Denied as 5.4.1. Sending from domains your tenant has not added and verified gives 5.7.750.
Related codes
- 5.7.57: Client not authenticated to send anonymous mail (Microsoft 365)
- 5.4.1: Recipient address rejected: access denied (Microsoft 365)
- 5.7.750: Blocked from sending from unregistered domains (Microsoft 365)
See every bounce code in the dictionary.
Many bounces from addresses that do not exist can be avoided: check an address with our free email checker, or clean a whole list before you send.
How we wrote this: drafted by the email-validation.org team with the help of AI writing tools, from our product documentation and the sources linked in the text.