550 5.4.1 Microsoft 365: recipient address rejected
Quick answer
On Microsoft 365, this reply means the recipient does not exist. Directory Based Edge Blocking checks every recipient against the organisation's directory and rejects unknown ones with 550 5.4.1 Recipient address rejected: Access denied.
Recommended action: Suppress the address
Common causes
- The person left the company and the mailbox was removed.
- A typo or a guessed address format that does not exist at the company.
- An address from an old or scraped B2B list.
What to do
Suppress the address. Despite the words "access denied", this is a missing recipient, not a block on you.
Provider note: Generic checkers read "access denied" as a policy block and return unknown. RocketVerifier applies Microsoft's dialect on Microsoft hosts and returns undeliverable with mailbox_not_found, while blocklist or banned-IP wording is still always treated as a block.
How to read 550 5.4.1
550 is the basic SMTP reply defined in RFC 5321. 5.4.1 is the enhanced status code from RFC 3463, which reads as class, subject and detail:
- Class
- 5Permanent failure
- Subject
- .4Network and routing
- Detail
- .1Microsoft 365: recipient address rejected
Further reading
FAQ
Frequently asked questions
Why does Microsoft say "access denied" for a missing user?
Directory Based Edge Blocking rejects unknown recipients at the network edge, and its reply text uses "access denied". The 5.4.1 code with "Recipient address rejected" is how Microsoft reports a recipient that is not in the directory.
Can 5.4.1 mean something else?
Outside Microsoft 365, 5.4.1 is defined in RFC 3463 as "no answer from host". Read it in context of the server that sent it.
Stop hard bounces before they start
Upload a list or call the API, and send only to addresses that can receive mail. Unknown results are always free.
100 free credits · No card required · Credits never expire