Why mail lands in spam or bounces
Anyone can write any address in the From line of an email. Receivers fight that with three DNS records on your domain. SPF lists the servers allowed to send for you. DKIM publishes a key that your mail service signs every message with. DMARC ties the two to the From address and tells receivers what to do when a message fails.
The Gmail, Yahoo and Outlook rules
Since February 2024, Gmail and Yahoo require senders of more than 5,000 messages a day to have SPF, DKIM and a DMARC record of at least p=none, with the From domain aligned to one of them. Outlook.com started refusing such mail on May 5, 2025. Smaller senders are not refused outright, but missing records still push mail toward spam.
Fixing Outlook 550 5.7.515
The bounce 550 5.7.515 Access denied, sending domain does not meet the required authentication level means Outlook could not pass your mail through SPF, DKIM and DMARC. Run this check, fix every line marked Fix, wait for DNS to update, and send again. If all three pass here and the bounce continues, the From domain is probably not aligned: your service signs with its own domain instead of yours. Turn on "custom domain" or "domain authentication" in its settings.
SPF: one record, ten lookups
A domain may have only one record that starts with v=spf1. Every service you add (Google Workspace, a newsletter tool, a help desk) adds an include, and each include can cost several DNS lookups. Receivers stop at 10 and fail SPF for all your mail. This page counts through every include. If you are over, remove services you stopped using first.
DKIM: find your selector
DNS cannot list DKIM keys, so this page tries common selector names. Google Workspace uses google, Microsoft 365 uses selector1 and selector2, and many services use s1, k1 or their own name. To find yours for sure, open an email you sent, show the original, and read the s= value in the DKIM-Signature header.
DMARC: start soft, then tighten
Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. The reports show every server sending as you. When only your own services appear, change to p=quarantine, and after a few clean weeks to p=reject. A domain that never sends mail should publish v=spf1 -all and p=reject so nobody can use it for phishing.
Frequently asked questions
What does Outlook error 550 5.7.515 mean?
Since May 5, 2025 Outlook.com, Hotmail and Live refuse mail from senders of more than 5,000 messages a day whose domain does not pass SPF, DKIM and DMARC. The bounce says 550 5.7.515 Access denied, sending domain does not meet the required authentication level. Fix the record this page marks as Fix, then send again.
Does this page send my domain anywhere?
Your browser asks Google Public DNS (dns.google), and Cloudflare DNS if Google does not answer, for the public DNS records of the domain you type. Those are the same records every mail server reads. Nothing is sent to raidandev, and there is no tracking or analytics on this page.
Why does it say no DKIM key was found?
A DKIM key sits at a name chosen by your mail service, called the selector. DNS has no way to list them, so the page tries common selectors. If yours has another name, type it in the selector box. You can find it in any email you sent: open the original message and look for s= in the DKIM-Signature header.
Is p=none good enough?
For the Gmail and Yahoo bulk-sender rules, yes: they ask for a DMARC record with at least p=none. It does not stop anyone from sending mail that pretends to be you, though. Read your DMARC reports for a few weeks, then move to p=quarantine and later p=reject.
What is the SPF 10-lookup limit?
While checking SPF, a receiver may do at most 10 DNS lookups. Each include:, a, mx, ptr, exists: and redirect= costs one, and so do the ones inside every include. Past 10, SPF fails for all your mail. This page counts them the same way, through every include.