5.7.64 TenantAttribution; Relay Access Denied

5.7.64 TenantAttribution; Relay Access Denied

Authentication is not the problem here - the message was accepted and then could not be attributed to a connector that permits relay. Classic after a device’s public IP changes, after a certificate on an inbound connector is replaced, or when a smart-host setup is moved to a new network. Check which connector should be matching this traffic and what it matches on, rather than the mailbox credentials.

Check it from the machine that is failing

npx zerosmtp-check --explain "5.7.64 TenantAttribution; Relay Access Denied"

No install and nothing sent. It reads the refusal your own client printed - which is rarely what the server said, because libraries and device panels rewrite it - and says which of these cases you are in.

If the send is hanging rather than being refused, the cause is usually the network and not the credentials. npx zerosmtp-check with no arguments checks ports 25, 587 and 465 from where you are standing.

This is not the Basic auth shutdown

Authentication worked. Do not change the authentication settings — the problem is the From address.

  1. Check what address the device or application puts in From.
  2. Check which mailbox the credentials belong to.
  3. If they differ, either set From to the authenticated mailbox, or grant that mailbox Send As on the address you want to use.

This turns up most often after pointing a device at a shared or service mailbox and leaving the old From address in its settings.

Two things this is often confused with

Symptom Actual cause
Connection times out; no authentication error ever appears The network is blocking outbound SMTP. Cloud providers block port 25 and often 587 by default — see troubleshooting.
Certificate verify failed / unable to get local issuer certificate The device’s trust store cannot validate the server certificate. Common on firmware predating current root CAs — see the Canon Maxify MB2755 case.

Source: Microsoft’s own list of Exchange Online error codes. This entry was written from that documentation rather than from watching a machine fail, which is worth knowing when you compare it against what your hardware actually printed.

Seeing a string that is not here? Report it with what produced it. Errors from real hardware are worth more than anything transcribed from documentation.

Last reviewed 2026-08-16.

Updated 22 Aug 2026

mx.msgwing.com587 STARTTLS · 465 SSL/TLS Register free