Error: 530 5.7.1 "You (X) are not authorized to send mail as Y"

If you receive an error containing 530 5.7.1, 501 5.1.7, or a bounce notice stating "You (X) are not authorized to send mail as Y", your email was blocked because the From address in your email does not match the permissions of the authenticated user sending it.

To protect domain reputation, prevent email spoofing, and comply with strict authentication standards enforced by major email providers (like Google, Yahoo, and Microsoft), Purelymail requires that authenticated users only send mail using email addresses they own and are authorized to use.

Why this error happens

In email standards, there are two "from" addresses:

• Envelope Sender (Return-Path / MAIL FROM): The address used behind the scenes for server routing and delivery status bounces.
• Header From (From:): The visible address displayed in your recipient's inbox.

Purelymail validates both addresses against your authenticated account:

• External / Third-Party Domains: If your email client or website logs into Purelymail as user@yourdomain.com, but sets the visible From: header to an unowned or third-party address (such as @gmail.com, @yahoo.com, or a website visitor's email), the message will be rejected.
• Account Sending Restrictions: If your Purelymail account has multiple users or domains and you have configured sending restrictions, users can only send from addresses explicitly permitted by your account settings.
• Malformed From Headers: If an automated script or client generates an email with multiple From: header lines, multiple comma-separated addresses in the From: field, or unparseable syntax, it will be rejected with a 501 error.

Common Error Messages

How to resolve it

1. Check the "From" address in your email client

If you are using an email client like Thunderbird, Outlook, Apple Mail, or a mobile app:

1. Open your account settings / identities.
2. Verify the Email Address / Default Identity: It must match the username you use to log in, or a verified alias configured under your account.
3. If you wish to send from an external email address (such as a personal Gmail or work email), configure your client to send through that provider's outgoing SMTP server, not Purelymail.

2. Website Contact Forms & Automated Scripts (WordPress, PHP, Webforms)

A very common cause of this error is contact form plugins configured to put the website visitor's email address directly into the From: field:

• Incorrect: Setting From: visitor@gmail.com (this fails because your website authenticated with Purelymail, but tried to send as @gmail.com).
• Correct Solution: Set the From: header to your own domain address (e.g., contact-form@yourdomain.com), and place the visitor's email in the Reply-To: header (e.g., Reply-To: visitor@gmail.com). When you click "Reply" in your email client, your response will still go directly to the visitor!

3. Check your account sending restrictions

If you want to allow all users to send from any address on your account (or conversely, if you want to ensure this is enabled), follow these steps:

1. Log in to your Purelymail Account Admin portal.

2. Navigate to Settings -> Sending Restrictions.

3. You will see two primary options:

   • Let users send from whoever they want: This is the default setting. It allows any user on your account to send as any address or alias on your hosted domains (it will still prevent sending as external domains like Gmail).

   • Restrict who users can send as: Select this if you wish to maintain strict control over which specific addresses each user can send from.

4. Configure a "Send As" Policy (Strict Control)

If you choose to Restrict who users can send as, you must explicitly tell the system which additional addresses a specific user is authorized to use.

1. Ensure Restrict who users can send as is selected in your Sending Restrictions.

2. Scroll down to the Send As Policies section.

3. Create a new policy that maps the authenticated user (e.g., joe@abc.com) to the additional address they need to send from (e.g., support@abc.com or team@seconddomain.com).

4. Once the policy is saved, the user will be authorized to send mail from that address.

Note: If you continue to see this error after updating your settings, ensure that your email client (Outlook, Thunderbird, Apple Mail, etc.) is configured to authenticate with the exact username and password of the account you are authorized to send from.