email bouncing back to trusted recipient

The bounce is caused by Outlook.com enforcing high‑volume sender authentication requirements for the domain DOMINIONLENDING.CA. The error:

Access denied, sending domain DOMINIONLENDING.CA doesn't meet the required authentication level. The sender's domain in the 5322.From address doesn't meet the authentication requirements defined for the sender.

means Microsoft consumer services (Outlook.com, Hotmail, Live, MSN) are treating this domain as a high‑volume sender and requiring full SPF, DKIM, and DMARC compliance for the 5322.From domain.

Key points from the error:

• SPF = Pass
• DKIM = Fail
• DMARC = Pass

For high‑volume senders to Outlook.com, all of the following must be true for the 5322.From domain:

1. SPF record is published and passes.
2. DKIM record is published and passes.
3. DMARC record is published.
4. DMARC validation passes with alignment (SPF and/or DKIM aligned to the 5322.From domain).

Even though DMARC is reported as Pass here, Outlook.com’s high‑volume policy requires that both SPF and DKIM checks pass for the domain once the volume threshold is crossed. Because DKIM fails for DOMINIONLENDING.CA, messages are rejected with NDR 550 5.7.515.

To fix this, the domain owner or mail administrator must:

1. Publish and correctly configure DKIM for DOMINIONLENDING.CA
   • Ensure DKIM DNS records exist for the domain.
   • Ensure the outbound mail system is signing messages with the correct DKIM selector and domain.
   • Verify in message headers that dkim=pass and that header.d (DKIM signing domain) aligns with the 5322.From domain (DOMINIONLENDING.CA).
2. Confirm SPF and DMARC are correctly aligned
   • SPF already passes, but confirm the smtp.mailfrom domain aligns with the 5322.From domain as required by DMARC.
   • Ensure the DMARC record (for example, _dmarc.DOMINIONLENDING.CA) is present and syntactically correct.
3. Re‑test by sending a message and checking headers
   • Use Outlook to view the internet message headers and confirm:
     • spf=pass
     • dkim=pass
     • dmarc=pass
     • The domains in smtp.mailfrom, header.d, and header.from are aligned as required.

Once DKIM is correctly configured and passes, and alignment is maintained, Outlook.com will accept messages and the 550 5.7.515 error will stop for this domain.

References:

• Fix NDR error "550 5.7.515" in Outlook.com
• Security Operations guide for email authentication in Microsoft 365
• Anti-spam message headers in cloud organizations
• Best practices for sender authentication support