A 550 5.7.1 sender-mismatch rejection usually means the authenticated identity is not allowed to submit as the address in the message From or envelope sender. Validate mailbox aliases, Send As/Send on Behalf rights and application sender configuration.
Step-by-step checks
Compare the authenticated SMTP account, envelope MAIL FROM and visible From header; document every identity instead of assuming they are the same.
Verify the sender address exists as the intended mailbox/shared mailbox/alias and that the authenticating principal has the required Send As or equivalent permission.
Check whether the application rewrites the sender, bounce/return-path or display address and whether the relay connector imposes an allowed-sender restriction.
After any permission change, allow for directory/transport propagation and retest with a minimal message using the exact production sender identity.
Useful verification commands
Use commands only on systems you administer and capture the read-only output before making a configuration change.
A controlled message must be accepted with the intended authenticated identity and From/envelope sender, and the received headers must show the expected sender without relay rewriting.
Evidence to keep
Keep authenticated account, MAIL FROM, From header, mailbox/alias ownership, delegated-send permissions, SMTP response and a successful message trace/header sample.
Frequently asked question
Can SMTP authentication succeed but sending still fail with 550 5.7.1?
Yes. Authentication proves who the client is; authorization separately determines which sender identities that account may use.