“550 relay not permitted” means the SMTP server has refused to forward your message. The server does not recognize your client as authorized to send mail to the recipient’s domain. In most cases, the fix is to enable SMTP authentication, use the provider’s correct submission host and port, and make the sender address match the authenticated account.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Other causes include using a receiving-only MX host for outgoing mail, submitting on port 25 instead of a client-submission port, a sender IP or DNS record that is not authorized, or a server-side relay rule that excludes your application. Work through the checks below in order; each one isolates a different policy decision made during the SMTP conversation.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What “550 relay not permitted” means
SMTP servers distinguish between delivering mail for domains they host and relaying mail to other domains. A server may accept messages for its own users without allowing an unknown client to submit a message addressed elsewhere. When your client issues the RCPT TO command for an outside domain, the server evaluates whether that client is trusted. If it is not, the server rejects the transaction with a 550-class policy error.
This is normally an authorization or configuration refusal, not a spam-reputation or blacklist verdict. The server is saying, in effect, “I will not forward this message for this connection.” The refusal can occur before authentication, after a failed authentication attempt, or after authentication if the sender, recipient domain, or relay policy still does not meet the server’s rules.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Recognize the exact error variant
Different products use slightly different text for the same class of relay refusal. Record the complete SMTP reply, including the enhanced status code, before changing settings.
| Reply you may see | What it usually indicates |
|---|---|
550 relay not permitted |
The server will not relay for the current client or message. |
550 5.7.1 Unable to relay |
Common wording in Microsoft Exchange and Jira-related configurations; the relay or sender policy rejected the transaction. |
550 5.7.1 Relaying denied or relaying denied (not permitted) |
The connection is not authorized to send to the requested recipient domain. |
554 5.7.1 : Relay access denied |
The same broad policy problem returned with a 554 reply code instead of 550. |
The wording alone does not identify the exact setting. The SMTP host, port, authentication result, envelope sender, recipient domain and server logs are needed to locate the failing rule.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick triage before changing anything
- Capture the server name and port. Check the account’s outgoing-server settings, not only the incoming IMAP or POP settings.
- Check whether authentication is enabled. The outgoing server should authenticate with the full email address as the username when the provider requires it.
- Check the submission port and encryption. Try port 587 with STARTTLS or port 465 with implicit TLS when those are the provider’s documented options. Do not assume port 25 is a client-submission port.
- Compare the From address with the authenticated account. A mailbox authenticated as one address may be prohibited from submitting mail that claims to be from another.
- Identify the recipient domain. If mail to local recipients works but mail to outside domains fails, the relay restriction is specifically being applied to external delivery.
- Inspect the exact stage of rejection. A failure during
AUTHpoints to credentials, TLS or port selection; a failure afterMAIL FROMorRCPT TOpoints to sender, recipient-domain or relay policy.
Fix 1: Enable SMTP authentication
Turn on outgoing authentication in the mail client
Open the account’s outgoing-server or SMTP settings and enable “server requires authentication,” “SMTP AUTH,” or the equivalent label. Select the option to use the same credentials as the incoming server only if the provider says those credentials are shared. Otherwise enter the outgoing account separately.
Use the complete mailbox address as the username, such as [email protected], rather than only the part before the @. Re-enter the password carefully. If the account uses multifactor authentication, the provider may require an app-specific password or another approved authentication method; a normal web-login password may be rejected even when it works in the browser.
Why authentication can appear to work but still fail
A client can save credentials without actually sending an AUTH command. It may also attempt authentication on a port where the server does not offer it, or before TLS is established when the server requires encryption first. Confirm in the client’s connection log that TLS was negotiated and that authentication completed successfully.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Fix 2: Use the correct outgoing host, port and TLS mode
Do not use the receiving MX host as a submission relay
DNS mail-exchange records identify servers that receive mail for a domain. They do not necessarily identify the hostname customers should use to submit outgoing messages. Enter the SMTP submission hostname documented for your mailbox or hosting account. A receiving-only MX host may accept mail from other servers yet refuse authenticated client relay.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteChoose a client-submission port
| Port | Typical role | What to check |
|---|---|---|
587 |
Message submission, normally with STARTTLS | Select STARTTLS or “TLS when available/required” according to the provider’s instructions, then authenticate. |
465 |
Submission with implicit TLS | Select SSL/TLS from the beginning of the connection; do not select STARTTLS for this mode. |
25 |
Traditionally server-to-server SMTP transport | Many providers do not permit ordinary clients to authenticate or relay on this port. Use the provider’s submission port instead. |
Port numbers are not interchangeable. A correct password on the wrong port can produce a relay error because the server never treats the connection as an authenticated submission session.
Check for network filtering
Some residential, office and cloud networks restrict outbound port 25. That restriction usually causes a timeout or connection failure rather than a 550 response, but it can lead administrators to switch hosts or ports incorrectly. If port 587 or 465 connects and port 25 does not, leave client submission on the supported port.
Fix 3: Make the sender address match the authenticated account
Set the visible From: address and the SMTP envelope sender to an address the authenticated account is allowed to use. Exchange environments and other managed relays commonly reject an unrecognized sender or a sender domain that the account is not permitted to represent.
Check all identities configured in the client, including aliases, shared mailboxes, “send as” addresses and automated application accounts. Test with the primary mailbox address first. If that succeeds, request or configure explicit permission for the alias rather than repeatedly changing passwords or ports.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Fix 4: Correct SPF, DKIM, DMARC and sender-IP authorization
If you operate the domain or an application that sends directly, ensure that every authorized sending service is represented in the domain’s mail-authentication records:
- SPF should authorize the public IP addresses or sending services that are allowed to send mail for the domain.
- DKIM should sign messages with a key whose public record is published for the signing domain.
- DMARC should define how receivers evaluate alignment between the visible From domain and SPF or DKIM results.
A missing or incorrect record does not always produce a relay refusal, but a provider may use sender-IP or DNS authorization as part of its relay policy. Check that the actual public IP, not an internal address, is covered. Include every system that sends mail: websites, game servers, ticket systems, monitoring tools and office applications.
Also check whether the sending IP appears on blocklists. A blocklist issue is distinct from an authorization refusal, but some providers combine reputation and relay policy checks and may return a similar 5.7.1 response.
Fix 5: Resolve Exchange or Jira “Unable to relay” cases
Microsoft Exchange
For Exchange, verify three separate items: the account authenticated successfully, the sender address is recognized or granted “send as” permission, and the recipient domain is allowed by the organization’s outbound policy. A receive connector can require authentication or restrict which source IPs may relay. Review the connector handling the connection and confirm that the application or client is using the connector intended for authenticated submission, not an anonymous inbound connector.
If only one application fails, compare its source IP, TLS setting, authentication method and envelope sender with a working client. If every client fails, investigate the connector, account or organization-wide outbound policy rather than the application code.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Jira Server mail settings
Jira Server can report 550 5.7.1 Unable to relay when its configured SMTP server does not permit the Jira host to relay. Confirm the SMTP hostname, port, TLS mode, username and password in Jira’s mail configuration. The sender address must be an address the relay accepts. If the relay authorizes by source IP, add the Jira server’s actual egress IP to the allowed source list or switch Jira to authenticated submission.
Fix 6: If you run the relay, adjust its authorization policy
Self-hosted administrators must decide which sources may relay and under what conditions. The safe pattern is to permit authenticated clients and explicitly trusted internal sources, while refusing unauthenticated delivery to destinations the server does not host. Do not solve the error by opening unrestricted relay access: an open relay can be abused to send large volumes of unsolicited mail and quickly damage the server’s reputation.
Allow the correct source
For an application that cannot authenticate, authorize its fixed private network or public egress address only when the network boundary is controlled. For mobile or changing clients, require SMTP authentication instead of maintaining a broad IP allowlist.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Review Exchange receive connectors
Check the connector’s accepted source ranges, authentication requirements and relay permissions. Ensure the source address listed in the connector is the address Exchange actually sees after NAT or a firewall. A stale internal address can make a correctly configured application appear unauthorized.
Review Postfix or Sendmail policy at a high level
On Postfix and Sendmail, inspect the submission service, SASL authentication status, trusted-network definitions and destination restrictions. The exact directives and syntax vary by release and distribution, so use the documentation for the installed version before editing configuration. Reload the service after a validated change and test both an internal recipient and an external recipient.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Diagnose the SMTP conversation directly
A protocol test separates client-interface problems from server-policy problems. Run the test from the same machine and network as the failing application where possible.
- Open a STARTTLS session to the submission service:
openssl s_client -starttls smtp -connect smtp.example.net:587. - After the TLS handshake, issue
EHLO test.example.netand confirm that the server advertises the capabilities expected for submission, including an authentication mechanism. - Authenticate using a test account through the mechanism supported by the server. Do not paste a real password into a shared terminal, ticket or log.
- Issue a test
MAIL FROMusing the same sender address configured in the application, then aRCPT TOfor a controlled external mailbox. - Record the first error code and the command that triggered it. If authentication fails, fix credentials, TLS or port selection. If authentication succeeds but
RCPT TOreturns 550 or 554, investigate sender permissions, recipient-domain policy and relay authorization.
Use a real test mailbox and a harmless message body. A successful TLS handshake proves encryption, not relay permission; a successful authentication proves identity, not necessarily permission to use every sender address or destination.
Read the server logs for the rejection stage
Mail logs usually identify the rule that returned the 5.7.1 response. On Unix mail servers, inspect the system’s mail log, commonly named /var/log/maillog or /var/log/mail.log. Exchange uses SMTP protocol and transport logs; Jira also records mail-connection errors in its application logs.
- Search for the connection time, authenticated username, source IP, envelope sender and recipient domain.
- Look for messages indicating failed authentication, an unauthorized sender, an untrusted source, a connector mismatch or a destination rejected by relay restrictions.
- Compare a failed transaction with a successful one. Differences in source IP, port, TLS state, sender and recipient often reveal the exact policy branch.
Redact passwords, authentication tokens and message content before sharing logs. Preserve the numeric SMTP code and the server-generated explanation.
Common mistakes that prolong the problem
- Changing only the password: a valid password cannot authorize a connection made to the wrong host or port.
- Using port 25 because it is the default: port 25 is commonly reserved for server transport and may not permit client authentication.
- Changing the visible From field but not the envelope sender: relay policy may evaluate the SMTP envelope independently of the message header.
- Adding a broad IP allowlist: this can create an unintended open relay, especially when the address range includes untrusted networks.
- Assuming SPF fixes relay authorization: SPF helps receivers evaluate sending authority; it does not replace SMTP authentication or a relay’s access rule.
- Testing only local recipients: a server may deliver locally while correctly refusing to relay to external domains.
- Ignoring NAT: the relay may see a firewall’s public egress address rather than the application server’s private address.
Final verification checklist
After making a change, send separate tests and record the result:
- The client connects to the provider’s documented SMTP submission hostname.
- The selected port matches the TLS mode: STARTTLS on 587 or implicit TLS on 465 when supported.
- SMTP authentication completes with the full mailbox username.
- The envelope sender is authorized for that account.
- An internal recipient succeeds.
- An external recipient succeeds.
- The domain’s SPF, DKIM and DMARC records include all legitimate sending systems when you operate the domain.
- The server log shows an authenticated or explicitly trusted relay decision rather than an anonymous relay attempt.
If the error remains after all eight checks, give the mail administrator or provider the exact reply, timestamp, source IP, SMTP host and port, authentication result, sender address and recipient domain. Those details let them locate the rejecting policy without exposing credentials.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
