Bypass M365 External Forwarding Blocks (Error 550 5.7.520)

Microsoft 365 blocks automatic email forwarding to external addresses by default, causing a 550 5.7.520 Access denied error when trying to route emails to third-party tools like Dext, HubSpot, or Xero.

To forward emails without lowering your tenant-wide security, you can use the Distribution List (DL) workaround. Exchange will process the forward because the initial rule points to an internal address.

The Routing Flow:

User Inbox Rule → Internal Distribution List → External Mail Contact → External App

Step 1: Create a Mail Contact

1. Open the Exchange Admin Center.
2. Go to Recipients > Contacts and click Add a mail contact.
3. Name it (e.g., HubSpot Ingestion) and enter the external destination email.
4. Click Save.

Step 2: Create a Distribution List

1. Go to Recipients > Groups > Distribution list.
2. Click Add a group.
3. Name it and set an internal email alias (e.g., [email protected]).

Step 3: Add the Mail Contact

1. Go to the Members tab of your new DL.
2. Add the Mail Contact created in Step 1. (This must be the only member).

Step 4: Set the Owner

1. Go to the Owners tab of the DL.
2. Assign an IT/Admin account to manage the group.

Step 5: Allow External Senders (Crucial)

1. Open the DL Settings (or Delivery management).
2. Select Allow external senders to email this group.
3. Click Save.

Step 6: Hide from the Global Address List

1. In the DL Settings, check Hide this group from the global address list. This prevents staff from manually selecting the forwarding address.
2. Click Save.

Step 7: Configure Forwarding (User or Admin)

Choose how the mail will be routed to your new internal DL.

Option A: User Inbox Rule (For Specific Emails)

1. Open Outlook Rules.
2. Set conditions (e.g., Subject contains “Invoice”).
3. Set the action to Forward to and select the internal DL ([email protected]).

Option B: Admin Mailbox Forwarding (For All Mail + Keep Copies)

1. In the Exchange Admin Center, go to Recipients > Mailboxes.
2. Select the user mailbox > Manage email forwarding.
3. Toggle on Forward all emails sent to this mailbox and select the internal DL.
4. Check Deliver message to both forwarding address and mailbox to ensure emails stay in the user’s inbox as well.
5. Click Save.

Disclaimer

This article is provided for general information only. Easy As IT does not recommend bypassing default security controls unless there is a specific business requirement to do so. Microsoft does not officially document this as a supported alternative to automatic forwarding policies, and administrators should carefully test their specific Exchange Online environments before implementing major changes.