# Microsoft 365 NDR: why wasn't my message delivered, and how do I fix it?

URL: https://iblockspam.com/blog/microsoft-365-ndr-message-not-delivered
Last updated: 2026-10-22
Published: 2026-10-22
Topic: Running email day to day
Author: iBlockSpam Team

> Read a Microsoft 365 non-delivery report (NDR): who rejected the message, what codes like 5.1.1, 5.7.1 and 5.7.509 mean, and how to fix each bounce.

## Short answer

A Microsoft 365 non-delivery report (NDR) is the bounce message you get when an email can't be delivered. Find the enhanced status code, such as 5.1.1 or 5.7.509, and the server that rejected the message in the diagnostic section. A 5.x.x code is permanent and 4.x.x temporary. The code shows who must fix it.

"Your message wasn't delivered" is one of the most common tickets an email admin sees. Microsoft 365 explains every bounce in a structured report, and the code inside usually tells you exactly who must fix what. The trick is knowing which line to read.

This guide shows how to read a Microsoft 365 non-delivery report, what the common codes mean, and the order to troubleshoot them in. For bounces on mailing lists, see [hard bounce vs soft bounce](https://iblockspam.com/blog/hard-bounce-vs-soft-bounce).

## What is a Microsoft 365 NDR?

A non-delivery report (NDR), also called a bounce, is the message Microsoft 365 sends back when an email couldn't be delivered. Microsoft says NDRs include "an error code that indicates the reason that your message wasn't delivered, solutions to help you get your email delivered, a link to more help on the web, and technical details for administrators" ([Microsoft Learn](https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/non-delivery-reports-in-exchange-online)).

Newer NDRs have these parts:

| Part | What it tells you |
|---|---|
| Office 365 logo | That Microsoft 365 generated the NDR, not that Microsoft caused the error |
| Cause | Why the message wasn't delivered, in plain language |
| Fix-it owner indicator | A graphic of sender, Microsoft 365 and recipient, with the party that must fix it in red |
| How to fix it | Steps for the person who sent the message |
| More info for email admins | Technical detail and a link to Microsoft's reference |
| Message hops | Timestamps and servers along the path |

Older-style NDRs split this into **User information** and **Diagnostic information for administrators**. The second part is where the answer is.

## How do you read the diagnostic information?

Here is the example Microsoft uses, shortened:

```text
Delivery has failed to these recipients or groups:
ronald@contoso.com
Your message wasn't delivered due to a permission or security issue. ...
The following organization rejected your message: mail.contoso.com.

Diagnostic information for administrators:
Generating server: alpineskihouse.com
ronald@contoso.com
mail.contoso.com #<exchange.contoso.com #5.7.1 smtp;530 5.7.1 Client was not authenticated> #SMTP#
```

Read three things:

1. **Generating server.** The server that wrote the NDR. If no remote server is listed, this server also rejected the message.
2. **Remote server.** The server that refused the message, here `mail.contoso.com`. Microsoft's conclusion for this example: "the administrators at contoso.com are responsible for understanding and fixing the problem."
3. **Enhanced status code and SMTP response.** Here `5.7.1` and `530 5.7.1 Client was not authenticated`.

The **enhanced status code** follows [RFC 3463](https://www.rfc-editor.org/rfc/rfc3463.html), in the form class.subject.detail. Microsoft summarizes it: "a 5.*x.x* code indicates a permanent error, and a 4.*x.x* code indicates a temporary error." The middle digit narrows the area: 1 for addressing, 4 for network and routing, 7 for security or policy. Paste the whole bounce into our [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes) for a plain-English reading.

The **Original message headers** at the bottom help too. Microsoft points to `To` for typos, `Received` for the path, and `Received-SPF` for authentication.

## What do the common Microsoft 365 NDR codes mean?

These are the codes admins meet most in everyday business mail, with Microsoft's text, quoted as examples, from its [NDR reference](https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/non-delivery-reports-in-exchange-online) at the time of writing (October 2026):

| Code | Text in the NDR | What it means | Who fixes it |
|---|---|---|---|
| [5.1.1](https://iblockspam.com/smtp-errors/550-5-1-1) | Bad destination mailbox address | Mistyped or non-existent address, or a stale Outlook cache entry | Sender |
| [5.1.10](https://iblockspam.com/smtp-errors/550-5-1-10) | Recipient not found | The SMTP address lookup found no such recipient | Sender, or recipient's admin |
| [5.7.1](https://iblockspam.com/smtp-errors/550-5-7-1) | Delivery not authorized | Not allowed to send to that recipient or group, or a mail flow rule rejected it | Recipient's admin or group owner |
| [5.7.124](https://iblockspam.com/smtp-errors/550-5-7-124) | Sender not in allowed-senders list | The distribution group only accepts listed senders | Group owner |
| [5.7.133 to 5.7.136](https://iblockspam.com/smtp-errors/550-5-7-133-136) | Sender not authenticated for group / mailbox | The recipient only accepts mail from inside its organization | Recipient's admin |
| [5.7.23](https://iblockspam.com/smtp-errors/550-5-7-23) | Rejected because of Sender Policy Framework violation | The receiver checked your SPF and it failed | Your admin |
| [5.7.509](https://iblockspam.com/smtp-errors/5-7-509-access-denied) | Sending domain does not pass DMARC verification and has a DMARC policy of reject | The From domain failed DMARC with `p=reject` | The sending domain's admin |
| [5.1.8](https://iblockspam.com/smtp-errors/550-5-1-8) | Access denied, bad outbound sender | Your account was blocked for sending too much spam | Your admin |
| 5.1.90 / 5.2.2 | Reached your daily limit for message recipients / Submission quota exceeded | You exceeded the recipient or message rate limit | Your admin; check for compromise |
| 5.7.233 | Tenant exceeded its daily limit for sending email to external recipients | The tenant external recipient rate limit was hit | Your admin |
| [5.7.520](https://iblockspam.com/smtp-errors/550-5-7-520) | Your organization does not allow external forwarding | An outbound spam policy blocked automatic forwarding | Your admin |
| 5.7.703 | Blocked by your organization using Tenant Allow Block List | Your own tenant blocks that recipient's address or domain | Your admin |
| [5.7.606 to 5.7.649](https://iblockspam.com/smtp-errors/550-5-7-606-649) | Access denied, banned sending IP | Microsoft banned the sending IP | The sending server's admin |
| [5.7.57](https://iblockspam.com/smtp-errors/550-5-7-57) | Client was not authenticated to send anonymous mail during MAIL FROM | A device or app relaying through `smtp.office365.com` is misconfigured | Your admin |
| [4.4.7](https://iblockspam.com/smtp-errors/550-4-4-7) | Message expired | Microsoft 365 kept retrying and the receiving server never accepted it | Usually the recipient's admin |
| 5.4.14 / [5.4.6](https://iblockspam.com/smtp-errors/554-5-4-6) | Routing loop detected | A forwarding or routing loop; Exchange stops after 20 iterations | Whoever owns the loop |

A few notes on the rows that need more than a lookup:

- **5.1.1** is usually a typo. If the address is right and the recipient is in your own organization, Microsoft says to remove the address from the sender's Outlook recipient cache and write a new message, because "resending the original message causes the same failure."
- **5.1.8, 5.1.90 and 5.2.2** can mean the account was compromised. Microsoft says 5.1.90 and 5.2.2 "could indicate that the account was compromised and is being used to send spam." Follow [unblocking a user restricted from sending](https://iblockspam.com/blog/microsoft-365-user-blocked-from-sending) before you unblock anyone.
- **5.7.509 and 5.7.23** are authentication problems with your domain, not the recipient's. Start with [why DMARC fails](https://iblockspam.com/blog/why-dmarc-fails).
- **5.7.703** surprises people because it's self-inflicted. Microsoft notes "the entire message is blocked for all internal and external recipients of the message, even if only one recipient email address or domain is defined in a block entry" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)). Review the entry in the [Tenant Allow/Block List](https://iblockspam.com/blog/microsoft-365-tenant-allow-block-list).

## How do you troubleshoot a Microsoft 365 NDR step by step?

1. **Get the full NDR.** Ask the user to forward the bounce as an attachment, or open it in Outlook and copy everything, including the diagnostic section. A screenshot of the first line isn't enough.
2. **Find who rejected it.** Read the remote server and the generating server. If the remote server belongs to the recipient's organization, the fix is probably on their side or in your authentication.
3. **Look up the code.** Use the table above or the [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes). A 4.x.x code means wait or watch; a 5.x.x code means something must change.
4. **Confirm in message trace.** In the Exchange admin center, go to **Mail flow** > **Message trace**, or run `Get-MessageTraceV2 -SenderAddress user@yourdomain.example -Status Failed -StartDate 10/20/2026 -EndDate 10/22/2026`. Message trace keeps 90 days of data, queried 10 days at a time ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-messagetracev2?view=exchange-ps)). Our [message trace guide](https://iblockspam.com/blog/microsoft-365-message-trace) explains the results.
5. **Check authentication if the code is 5.7.x.** Send a test message to an outside mailbox and read the `Authentication-Results` header in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). Check your records with the [SPF Checker](https://iblockspam.com/tools/spf-checker) and [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
6. **Run Microsoft's diagnostic.** Microsoft 365 admins can paste the NDR code into the automated NDR diagnostic linked from Microsoft's NDR article, which opens in the Microsoft 365 admin center. It isn't available in Government, 21Vianet or Germany clouds.
7. **Fix, then send a new message.** Don't just resend the old one, especially for 5.1.1.

## What causes Microsoft 365 NDRs, from the simplest fix up?

Work through causes in this order, because the early ones are quick to rule out:

- **A wrong or retired address.** Codes 5.1.1 and 5.1.10. Check spelling, ask whether the person left, and clear the Outlook autocomplete entry.
- **A restriction on the recipient.** Codes 5.7.1, 5.7.124 and 5.7.133 to 5.7.136. Groups and some mailboxes accept only listed or internal senders. Only the group owner or their admin can change that; see [restricting who can email distribution lists](https://iblockspam.com/blog/restrict-who-can-email-distribution-lists) for how it's set.
- **Your domain fails authentication.** Codes 5.7.23 and 5.7.509. Common after adding a new sending service that isn't in SPF or doesn't sign with DKIM.
- **Your own tenant's settings.** Codes 5.7.520 ([forwarding blocked](https://iblockspam.com/blog/microsoft-365-email-forwarding-blocked-error)) and 5.7.703 (Tenant Allow/Block List).
- **Sending limits or a restricted account.** Codes 5.1.8, 5.1.90, 5.2.2 and 5.7.233. The Exchange Online recipient rate limit is 10,000 recipients per day per mailbox ([Microsoft Learn](https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits)). When an ordinary user hits these limits, check for a compromised account before anything else.
- **Server and routing problems.** Codes 4.4.7, 5.4.14 and 5.7.57. These come from connectors, devices, MX records or loops, often after a migration.

### Got an NDR for a message you never sent?

That's usually **backscatter**: a spammer forged your address, and the receiving server bounced the message to you. Check the original headers in the NDR. If the message never left your tenant, it won't appear in message trace. Our guide to [backscatter bounce messages](https://iblockspam.com/blog/backscatter-spam-bounce-messages) explains what to do, and DMARC at `p=reject` makes your domain less attractive to forge.

## Next steps

- Save the table above, or bookmark the [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes), for the next bounce ticket.
- Make sure the **User restricted from sending email** alert reaches whoever handles incidents, so 5.1.8 never surprises you.
- Review Tenant Allow/Block List entries that could cause 5.7.703.
- Check your SPF, DKIM and DMARC before they cause 5.7.23 or 5.7.509 at someone else's server.
- If inbound mail problems are the bigger worry, see how iBlockSpam holds mail for up to 5 days during outages and filters it before it reaches [Microsoft 365](https://iblockspam.com/platforms/microsoft-365).

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Who has to fix a Microsoft 365 NDR, the sender or the recipient's admin?

It depends on who rejected the message. Look at the Remote server line in the diagnostic section and the fix-it owner graphic in newer NDRs. A typo or your own account limit is the sender's to fix. A block, an SPF or DMARC failure, or a group restriction on the other side usually needs one of the two admins.

### Should I resend a message after a Microsoft 365 NDR?

Only after fixing the cause. Microsoft notes that for 5.1.1 caused by a stale Outlook recipient cache, resending the original message causes the same failure; remove the cached address and write a new message. For 4.x.x temporary errors, the sending server keeps retrying; an NDR such as 4.4.7 Message expired arrives only when it gives up.

### Why did one recipient get my email when another got an NDR?

Each recipient is delivered separately, and the NDR lists only the addresses that failed with a reason under each one. One domain can reject you for SPF or a block while another accepts the same message. The exception is a Tenant Allow/Block List block on your side: Microsoft blocks the whole message for every recipient.

### How do I find the NDR for a message the user already deleted?

Run a message trace in the Exchange admin center or with Get-MessageTraceV2 -Status Failed for that sender and date range. The trace shows the failed event and its error text for up to 90 days back, so you don't need the bounce itself. Ask the user for the time and the recipient address to narrow it down.

### What does 'Routing loop detected' mean in a Microsoft 365 bounce?

It means a configuration error made the message loop between systems. Exchange Online reports 5.4.14 and on-premises Exchange reports 5.4.6. Exchange stops the loop after 20 iterations and sends an NDR. Microsoft suggests checking the sender's and recipient's mailbox rules to see whether automatic forwarding is enabled.

## Sources

- [Microsoft Learn: Email nondelivery reports (NDRs) and SMTP errors in Exchange Online](https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/non-delivery-reports-in-exchange-online)
- [Microsoft Learn: Get-MessageTraceV2](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-messagetracev2?view=exchange-ps)
- [Microsoft Learn: Exchange Online limits (sending limits)](https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits)
- [Microsoft Learn: Control external email forwarding and fix 5.7.520 errors](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding)
- [RFC 3463: Enhanced Mail System Status Codes](https://www.rfc-editor.org/rfc/rfc3463.html)
- [Microsoft Learn: Allow or block email using the Tenant Allow/Block List](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)

## Free tools for this guide

- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-ndr-message-not-delivered (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt