DKIM 550 5.7.515

We got multiple issues with sending emails towards hotmail / outlook.com
Mails are being rejected because of DKIM failure.

DKIM alignment, SPF and also DMARC is setup correctly and functional.

Below you'll find a SMTP header from a mail which was sent to strato, DKIM says PASS:

X-Envelope-From: ******@XXXXXXXX.de

X-Envelope-To: ******@XXXXXX.de

X-Delivery-Time: 1756384734

X-UID: 2640

Return-Path: ******@XXXXXXX.de

ARC-Seal: i=1; a=rsa-sha256; t=1756384734; cv=none;

d=strato.com; s=strato-dkim-0002;

b=YrjpQ7DeZJZjaBzyD7uJN3uz2l6sCRk3QiZcECQnF3Vo2uIF2/8Z8Qq4C6+BHd4Jx1

H8BdETdNJCfa+z9tsn6GPZ/UUF9cBeP8tirVCpiTfQhPiB6Y+OxBSmrH5qh8UdQHNYuQ

+NgNcuR5oOwJ9RVeZwMYPukOHb1drVwPZ6yIK97wm6gTlWsKpfCFrWe4dyGuiOmQzyW5

kk7MeAefNeTBMfLl/3V5BxGKVWQapyYR06xqzf8Yuk0zFiXOH+Xv9JqMgTQ6z90+z+wQ

OX7IaRItsAikwarTNa+w7/0+7NY3RTFmkWMrrgLUt74KIC5IV11j22WG8eQD/s9KcOzL

DaTQ==
```ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; t=1756384734;

```powershell
s=strato-dkim-0002; d=strato.com;

h=To:From:Subject:Message-ID:Date:Cc:Date:From:Subject:Sender;

bh=w3bVUaX9vVWyW9QMDwf4woNJgRfZ/s1GeQwUTLYvWcQ=;

b=bNkDF5p/Pq36imUoKVl8T9gEoqQk+xKuG+L9iGzRa0NStLmpqe0jo5hmqboyPelPzZ

Di4E4qEkxm6l3hrcmKJ/m/gl+xYgH+kYy+qE9IVM++gSd+yYRL48wgpMajvZ6WOXamBC

80dkn9loEZ5Z+2cZgevqBHhsY2tcLKTN8TbkaMmz3wdgz25I+gB5RwjVI+h1b4XdwB29

D+MRhOHsI8u/0htOsh3Xjpega15rmOVWuoa+tTn2cbFXThkWLlKFgSvvzRxh4goOCJ2o

31Ob/I9d24ozcTkbZbvj7960X2HvHoCln00G2aH/3FQVsaKYsJIe7KXMRZzXRyWZgFZ4

T24w==
```ARC-Authentication-Results: i=1; strato.com;

```sql
dmarc=pass (p=QUARANTINE sp=NONE) header.from="XXXXXX.de";

arc=none smtp.remote-ip=1XXXXXX;

dkim=pass header.d="XXXXXXX.de" header.s="mail" header.a="rsa-sha256";

dkim-adsp=pass;

spf=pass smtp.mailfrom="******@XXXXXXX.de"
```Authentication-Results: strato.com;

```sql
dmarc=pass (p=QUARANTINE sp=NONE) header.from="xxxxxx.de";

arc=none smtp.remote-ip=1XXXXXXXXX;

dkim=pass header.d="XXXXXXXX.de" header.s="mail" header.a="rsa-sha256";

dkim-adsp=pass;

spf=pass smtp.mailfrom="******@XXXXXXXX.de"
```X-RZG-Expurgate: suspect/normal

X-RZG-Expurgate-ID: 149500::1756384734-0DA15F3E-474D6AB2/23/0

X-RZG-CLASS-ID: mi00

Received-SPF: pass

```sql
(strato.com: domain XXXXXX.de designates 1XXXXXXXX as permitted sender)

mechanism=a;

client-ip=1XXXXXXXX;

helo="mx4.XXXXXXXX.de";

envelope-from="******@XXXXXXXXX.de";

receiver=smtpin.rzone.de;

identity=mailfrom;  
```But when the same email is sent to my outlook account:  
  
2025-08-28 14:33:34.606 1urbop-004J3I-O0 <= ******@XXXXXX.de H=wXb-pXXX-bo01.XXXX.XXX [10.XXX.XXX.XXX] P=esmtps X=TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256 CV=no S=522594 2025-08-28 14:33:38.605 1urbop-004J3I-O0 H=outlook-com.olc.protection.outlook.com [52.101.41.184] TLS error on connection (recv): The TLS connection was non-properly terminated. 2025-08-28 14:33:38.627 1urbop-004J3I-O0 ** ******@outlook.com R=dnslookup T=remote_smtp H=outlook-com.olc.protection.outlook.com [52.101.41.184] X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256 CV=yes: SMTP error from remote mail server after end of data: 550 5.7.515 Access denied**,** DE doesn't meet the required authentication level. The sender's domain in the 5322.From address doesn't meet the authentication requirements defined for the sender. To learn how to fix this see: [https://go.microsoft.com/fwlink/p/?linkid=2319303](https://go.microsoft.com/fwlink/p/?linkid=2319303%22https://go.microsoft.com/fwlink/p/?linkid=2319303%22) Spf= Pass , Dkim= Fail , DMARC= Pass [GV1P195MB1787.EURP195.PROD.OUTLOOK.COM 2025-08-28T12:33:38.442Z 08DDE29431F2C2EE] [SJ2PR07CA0003.namprd07.prod.outlook.com 2025-08-28T12:33:38.522Z 08DDE601EE144D68] [BY1PEPF0001AE1A.namprd04.prod.outlook.com 2025-08-28T12:33:38.515Z 08DDE28D60344DB8] 2025-08-28 14:33:38.683 1urbop-004J3I-O0 Completed QT=4.118s  

btw. this seems to be a common issue @Microsoft, it seems that something is breaking the DKIM.  
  
  
How can this be fixed?