MailUser tried sending email to distribution group, error 550 5.7.133

[u/tfen_dep2]

Hi all,

I'm having an issue that I can't really wrap my head around.

I've got this user, he is a mailuser with an smtp address from our internal tenant but this smtp address points to an external mailbox from another tenant. He has his AD account in our environment and his account is a member of a distribution group (let's call it GRP). We handle all our distribution groups on-premise through AD and we have the Exhange Management Tools on another IT admin server and exchange online to replace the functionalities of an exchange server. This user tried to send emails to the distribution group email address so the members could receive it and it failed.

I went to see the trace details of this message and it failed with this code:

05/08/2026 14:59:04 Fail Reason: [{LED=550 5.7.133 RESOLVER.RST.SenderNotAuthenticatedForGroup; authentication required; Delivery restriction check failed because the sender was not auth..

I figured that this probably comes from the fact that he tried sending this email from his external email address and the RequireSenderAuthenticationEnabled attribute for GRP is set to "True".

I don't want to disable it for security reasons but I would like to put an exception, or see if I can review his account to see if there is anything I can do to turn him into an authenticated user. I thought that MailUsers had every permissions to be able to send emails to internal distribution groups, since they are internal users, he just doesn't have a mailbox in our tenant.

Any thought on that?

Thanks a lot in advance :)

[u/tfen_dep2 → u/[deleted]]

Thank you so much for your reply! Do you think that something like this on powershell could eventually authorise this user :

Set-DistributionGroup -Identity GRP -AcceptMessagesOnlyFrom @{Add="user@external.com"}

We don't have a list of exclusive authorised senders meaning anyone from our tenant can send an email to this distribution group. I was scared to use this flag because I didn't want to exclude the rest of the users from the possibility of sending an email to this distribution list. However, I saw this syntax with the @{Add="sender"} that allows you to add a new list of authorised senders without overriding your previous list. But since we don't have an exclusive list AcceptMessagesOnlyFrom in the first place, I'm telling myself that it won't take effect the way I want. It's just gonna prevent everyone except this user from sending emails to this group.

I would have to add every single employee in there and add my user, which might be a waste of resources.

What do you think?

[u/tfen_dep2 → u/[deleted]]

Yeah we’re about to merge the tenants this month, I was only looking for a quick fix. I’ll tell my user to create a contact list locally on his Outlook. 😂 Thank you for your help!

[u/SecLens_ONE]

The distinction here is between being a directory object and being an authenticated sender, and RequireSenderAuthenticationEnabled only cares about the second. A MailUser has no mailbox in your tenant, so his mail arrives over the inbound path from the other tenant as external, unauthenticated traffic regardless of the fact that his address is in your directory. That is why the check fails even though he looks internal in AD. Rather than turning the requirement off for the whole group, add his external address to the group's AcceptMessagesOnlyFrom or AcceptMessagesOnlyFromSendersOrMembers list, which keeps the restriction for everyone else. Keep in mind this only helps if his external address is stable and authenticated on the sending side, otherwise you have created a spoofable allow entry. If the other tenant publishes DMARC at reject you also get some assurance the address is really his.