554 5.7.1 Relay Access Denied: What It Means and How to Fix It
The error "554 5.7.1 relay access denied" is a permanent SMTP rejection: the mail server refuses to forward your message because it does not recognize you as an authorized sender. Because it is a 5xx (permanent) error, the message will not retry on its own. It sits in your outbox until you fix the cause, which is almost always SMTP authentication that is turned off or misconfigured. The fix is to connect to the right server, on the right port, with the right credentials.
What "554 5.7.1 relay access denied" means
"Relay" means passing a message through an intermediate mail server to reach its destination. "Access denied" means that server rejected the request because it does not treat you as an authorized sender. Every email passes through two servers: your outgoing (sending) server and the recipient's incoming server. Either one can refuse to relay, and either refusal produces this error.
The leading digit is the important part. A 554 is a 5xx code, which the SMTP standard (RFC 5321) defines as a permanent failure: the sending server gives up rather than queuing the message for a later attempt. Its temporary twin, 454 4.7.1, uses a 4xx code, so the server keeps retrying on its own. If you are seeing 554, nothing resolves until you change something.
What causes relay access denied
The message is about authorization, not about the recipient's address. A handful of causes account for nearly all cases:
- SMTP authentication is disabled or misconfigured in your email client, so the server treats you as an anonymous sender.
- The outgoing server, port, or encryption setting is wrong, which makes authentication fail silently and looks identical to a relay block.
- You are using POP before SMTP, a legacy method that ties authorization to your IP address; when your IP changes (switching WiFi or mobile networks), the relay breaks.
- The domain's MX records point to a server that is not configured to accept mail for that domain.
- The recipient's server or security gateway enforces a closed-relay policy or fails your server on an anti-spam or sender-verification check.
- Your sending IP is on a blacklist, so the receiving side refuses to relay for it.
How to fix 554 5.7.1 relay access denied
To fix relay access denied, enable SMTP authentication in your mail client and confirm you are using the correct outgoing server, port, and encryption. Work through these steps in order.
- Turn on SMTP authentication. In your account's outgoing server (SMTP) settings, enable "My outgoing server requires authentication" and confirm the username and password match your provider's requirements.
- Check the server, port, and encryption. A port or encryption mismatch is a common hidden cause; verify yours against the table below, and see our guide to IMAP, POP3, and SMTP ports if you are unsure which to use.
- Use an app password if you have two-factor authentication. Gmail and other providers block a regular password from third-party clients; generate a 16-character app password and use it instead.
- Confirm your MX and authentication records. Make sure your MX record points to your actual provider, and that your SPF, DKIM, and DMARC records resolve, since enterprise gateways inspect these before accepting mail.
- Rule out a blacklist. Run a quick email blacklist check on your sending domain or IP, and address the cause before requesting delisting.
| Provider | SMTP server | Port | Encryption |
|---|---|---|---|
| Gmail | smtp.gmail.com | 587 | TLS / STARTTLS |
| Outlook / Microsoft 365 | smtp.office365.com | 587 | STARTTLS |
| Yahoo | smtp.mail.yahoo.com | 465 | SSL |
| iCloud | smtp.mail.me.com | 587 | TLS |
554 5.7.1 vs 454 4.7.1 vs 550
These codes look similar but point to different problems, so read the exact string before you troubleshoot. A 554 5.7.1 is about relay authorization, a 454 4.7.1 is the temporary version of the same block, and a 550 points at the recipient's mailbox instead.
| Code | Type | What it means |
|---|---|---|
| 554 5.7.1 | Permanent (5xx) | Relay refused; you are not authorized and the server will not retry |
| 454 4.7.1 | Temporary (4xx) | Relay refused for now; the server retries automatically |
| 550 | Permanent (5xx) | Recipient mailbox is invalid or rejected the message |
A wrong recipient address does not cause 554 5.7.1. If the mailbox is the problem, you get a 550 instead, which our guide to email bounce code 550 covers in detail.
If you run your own mail server
When every one of your users suddenly hits this error, the problem is usually server-side rather than in one client. Check these first:
- SMTP authentication must be enabled on the server itself, not only in the client. On Postfix, confirm that smtpd_relay_restrictions permits authenticated senders (permit_sasl_authenticated).
- A recent software or control-panel update may have reset your mail configuration; sudden failures after a smooth stretch often trace back to an overnight update.
- Trusted IP addresses that relay without authentication need to be whitelisted deliberately.
- If you send through an enterprise gateway (Proofpoint, Mimecast, Barracuda), the sending address must be registered as an authorized sender, and policy changes there take 30 to 60 minutes to propagate.
FAQs
How do I fix 554 5.7.1 relay access denied?
Enable SMTP authentication in your mail client, then confirm the outgoing server, port, and encryption are correct for your provider. If you use two-factor authentication, switch to an app password. On your own server, make sure authentication is enabled server-side.
What does relay access denied mean?
It means the mail server refused to forward your message because it does not consider you an authorized sender. Relaying is passing mail through a server to another destination, and the server blocks that unless you authenticate correctly.
What is the difference between 554 5.7.1 and 454 4.7.1?
Both signal a relay refusal, but 554 is a permanent 5xx error that will not retry, while 454 is a temporary 4xx error that the sending server retries automatically. A 554 needs you to fix something; a 454 often clears on its own.
Can a wrong recipient address cause 554 5.7.1?
No. An invalid recipient produces a 550 error, not 554 5.7.1. The 554 5.7.1 code specifically means relay authorization failed, which is unrelated to whether the recipient's address exists.
Why did this error start suddenly when nothing changed?
Something usually did change without notice: your IP address shifted on a home or mobile network, your provider updated its security requirements, two-factor authentication invalidated an old password, or a server update reset your SMTP settings.
Fixing relay access denied gets your mail sending again, but reaching the inbox is a separate job that starts with a clean list. Run your contacts through BounceCheck before your next send so invalid addresses are not quietly costing you deliverability.
BounceCheck Team
The team behind BounceCheck - helping businesses verify emails and improve deliverability.
