550 5.4.1 Recipient address rejected: Access denied
Microsoft 365 rejected the recipient at its network edge because the address isn't a valid recipient in that organization.
550 5.4.1 Recipient address rejected: Access denied
The NDR text, as given in Microsoft's articles on 550 5.4.1 and Directory-Based Edge Blocking.
What 550 5.4.1 means
Microsoft documents this NDR as the result of Directory-Based Edge Blocking (DBEB). DBEB rejects messages for invalid recipients at the edge of Microsoft 365: if the address doesn't exist in the organization, the message is blocked before any filtering runs, and the sender gets "550 5.4.1 Recipient address rejected: Access denied".
For senders, it means the same as "user unknown": check the address. For the recipient's admin, Microsoft gives a checklist. Check the spelling. Find out if one recipient or the whole domain is affected. If the whole domain is affected, resync it by switching its accepted domain type from Authoritative to Internal relay and back. For hybrid setups, reset the recipient's SMTP proxy address and allow up to 24 hours for DBEB to update, sync on-premises mail-enabled public folders, or create a mail contact for an on-premises dynamic distribution group.
Microsoft's NDR reference also lists a different 5.4.1, "Relay Access Denied", which means the server that returned it doesn't accept mail for the recipient's domain, caused by mail server or DNS misconfiguration.
Likely causes
- A typo in the recipient address.
- The mailbox or alias doesn't exist in the Microsoft 365 organization.
- Directory sync hasn't updated the recipient in a hybrid setup.
- An on-premises public folder or dynamic distribution group isn't represented in Exchange Online.
How to fix it
If you sent the message
- Check the address spelling and confirm it with the recipient.
- If the address is right, send the NDR to the recipient so their admin can check.
If you're the recipient or their admin
- Confirm the address or alias exists in Microsoft 365.
- If the whole domain is affected, switch the accepted domain from Authoritative to Internal relay and back.
- In hybrid setups, reset the recipient's SMTP proxy address and allow up to 24 hours.
- During a migration, keep the domain on Internal relay until all recipients exist in Exchange Online.
Frequently asked questions
Does 550 5.4.1 mean I'm blocked?
No. Microsoft returns it when the recipient address isn't valid in the receiving organization. Check the address; if it's right, the recipient's admin needs to check their directory.
Why do all addresses at a domain get 550 5.4.1?
That points to a configuration problem on the recipient's side, such as a domain not fully set up after a migration. Microsoft suggests switching the accepted domain type to Internal relay and back to Authoritative to resync it.
Sources
- Fix NDR error "550 5.4.1" in Exchange Online (Microsoft Learn)
- Use Directory-Based Edge Blocking to reject messages sent to invalid recipients in Exchange Online (Microsoft Learn)
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
Related guides
How to change MX records without losing email
A cutover checklist for MX changes: lower TTL, stage the new destination, keep the old server accepting mail, verify with headers and roll back cleanly.
11 min read Setup guidesHow to use an external spam filter with Microsoft 365 and Enhanced Filtering for Connectors
How to run an MX-level spam filter in front of Exchange Online: Partner connector, Enhanced Filtering for Connectors, why not SCL -1, headers and rollback.
10 min read Switching & migrationHow to switch spam filter providers without a gap in protection
Move from one MX spam filter to another: export lists, keep quarantine access, run both connectors during overlap, change MX and remove the old service.
9 min read