554 5.7.1 Relay Access Denied: What It Means and How to Fix It

"Relay access denied" is a mail server saying: you asked me to deliver this to a domain I do not host, and you have not proved you are allowed to use me for that. Every server refuses that by default, otherwise it would be an open relay for spammers. The error has two very different causes depending on where you see it. In your own mail app, it means the app did not log in before sending. In a bounce from someone writing to you, it means your domain's MX points at a server that does not know it hosts your domain.

Quick answer

In a mail app or script: turn on authentication for the outgoing server, use your full address as the username and your webmail password, and use port 587 with STARTTLS on mail.oqumail.com. If other people get this error when they email you: run the domain through the free MX lookup and make sure the MX points at your current provider and the domain is verified there.

How the error looks

• From a Postfix server: "554 5.7.1 <name@otherdomain.com>: Relay access denied".
• From Exim: "550 relay not permitted" or "550 Relaying denied".
• From Microsoft: "550 5.7.1 Unable to relay" or "550 5.7.64 TenantAttribution; Relay Access Denied".
• In Outlook: "Sending reported error (0x800CCC79): The server rejected one or more recipient addresses. The server response was: 554 5.7.1 Relay access denied."
• In Thunderbird: "An error occurred while sending mail. The mail server responded: Relay access denied."

Cause 1: your mail app is not logging in

Mail apps have a separate login for the outgoing server, and a few leave it off by default or lose it when settings are copied. Without a login, the server treats the app as a stranger and refuses to relay to any outside domain. Mail to addresses on the same server sometimes still works, which is why the error can appear only for some recipients.

1. Open the account settings and find the outgoing (SMTP) server section.
2. Set the server to mail.oqumail.com, port 587, encryption STARTTLS.
3. Set authentication to Normal password (or Password), username your full email address, and enter the webmail password. In Outlook this is "My outgoing server requires authentication" with "Use same settings as my incoming mail server".
4. Save and send a test to an address on another domain, such as a Gmail address.

Cause 2: you are using the wrong outgoing server

If the outgoing server in the app belongs to a previous provider, your internet provider or your web host, it will relay only for its own customers and domains. The fix is the same: point the app at mail.oqumail.com with the mailbox login. The same applies to scripts and website plugins that still have an old SMTP host in their configuration.

Cause 3: people cannot write to you

When senders get "Relay access denied" for messages to your domain, their mail reached a server that does not host your domain. That happens when the MX records (the settings that tell the internet where to deliver email for your domain) points at an old host after you cancelled the account, at a web server that never ran mail, or at the new provider before the domain was verified there.

1. Look up the MX records (the settings that tell the internet where to deliver email for your domain) for your domain. It should name your current mail provider only.
2. For OquMail that is a single MX at the root with value mail.oqumail.com and priority 10, and the domain must show as verified in the dashboard.
3. Delete MX records that point at former providers. A second provider in the list receives some of the mail and refuses it.
4. Wait for the TTL, then ask the sender to try again or send yourself a test from an outside address.

Common questions

Why does it work on Wi-Fi at home but not on mobile data?

The outgoing server is one that relays based on network rather than login, typically an internet provider's server. Switch to mail.oqumail.com with authentication and it works everywhere.

Authentication is on and it still says relay denied.

Then the login did not succeed and the app fell back to sending anonymously. Check the username is the full address and the password is current; the cannot authenticate guide covers the rest.

Is this a blocklist?

No. Blocklist rejections mention a list name or a reputation. Relay denial is purely about permission to use that server.

Want to see how your own domain is set up? Use the free MX lookup: it runs in your browser and stores nothing.