Unable to relay for external recipients while internal works is a specific and usually intentional condition, because relaying is the act of accepting mail for delivery elsewhere and denying it is often the server correctly refusing to be an open relay, so the meaning then the legitimate fixes:

What relaying means: a mail server relays when it accepts a message from a sender and forwards it toward a recipient in another domain, and an open relay, one that relays for anyone, is a spam vector servers rightly refuse. So 550 5.7.1 unable to relay means the server declined to forward your mail to an external domain because it does not consider you authorized to relay through it, which for external recipients is the server protecting itself, correctly by default.

Why internal works but external does not: the server accepts mail to its own domains because those are local delivery, not relaying, while mail to external domains requires relay permission, which the server grants only to authenticated or trusted senders. So the condition is almost always an authentication or authorization gap, the sender not proving they are allowed to relay externally through this server.

The common causes and fixes: unauthenticated SMTP, an application or device sending without authenticating, needs to authenticate with credentials the server accepts for relay, the proper fix being authenticated submission on port 587 rather than anonymous relay. A device or application that cannot authenticate, a scanner or line of business app, needs an explicit relay connector or receive connector permitting its IP address to relay, the controlled exception rather than opening the server. And a legitimate client misconfigured to not use authentication for outgoing mail simply needs SMTP authentication enabled in its settings.

The security framing that should guide the fix: the answer is never to make the server an open relay, since that invites spam abuse and blacklisting, but to grant relay to authenticated senders and specific trusted IPs deliberately. For a user's client, enable outgoing authentication. For an application or device, a scoped relay connector permitting its specific IP to send to external domains, the authorized exception. The 550 5.7.1 is the server doing its job, and the fix is proper authorization rather than removing the protection, keeping the server closed to everyone except who you explicitly permit.