FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 5,242,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
FaultyPacket Fix Guide · reviewed Oct 2026

550 5.7.515: Fix "Access Denied, Sending Domain Does Not Meet the Required Authentication Level"

The short answer (what's causing it)

Microsoft's consumer mailboxes (Outlook.com, Hotmail, Live) reject mail from high-volume senders whose domain does not pass SPF, DKIM and DMARC. The 5.7.515 code means at least one of those requirements is missing or failing for the From: domain.

Step-by-step fix

  1. Confirm the bounce came from an Outlook.com/Hotmail recipient (not your own M365 tenant).
  2. Scan your domain free and check SPF passes for the actual sending IPs.
  3. Enable DKIM in every platform that sends as your domain.
  4. Publish a DMARC record (at least p=none) that aligns with SPF or DKIM.
  5. Send a test to an Outlook.com mailbox and check the headers for spf=pass, dkim=pass, dmarc=pass.

Record examples (replace example.co.uk with your domain)

_dmarc.example.co.uk.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r"

Examples are illustrative templates, not values for your domain. Test changes at p=none / staging first.

Check yours free in seconds

Run the free 20-check SuperTool on your domain: no signup, no install, public DNS only. Relevant checks: SPF, DKIM, DMARC, Sender verdict.

Scan my domain free (20-check SuperTool) → £24 Sovereign DMARC (T0 RUA), SPF, MTA-STS & PHP2Shell Remediation Pack → £5 Website Launch Special Quick-Fix Pack →

One-off download via PayPal guest checkout, no subscription. Packs contain DNS/config templates and scripts you run yourself.

Frequently Asked Questions

Does this affect my own Microsoft 365 users?

The 5.7.515 rule targets consumer Outlook.com mailboxes; business tenants have their own filtering.

Is p=none enough?

Microsoft's published requirement is a DMARC record of at least p=none that aligns; stronger is better long term.

Related FaultyPacket guides & tools

Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.