550 5.4.1: recipient rejected by Directory-Based Edge Blocking
Microsoft 365 rejected the message at its edge because the recipient address does not exist in the destination tenant.
- Microsoft
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550 5.4.1
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- Either side, depending on the cause. Start with the checks below that are yours.
- What the server says
550 5.4.1 Recipient address rejected: Access denied
What it means
Directory-Based Edge Blocking checks recipients against the tenant's directory as mail arrives and rejects unknown addresses at once with 550 5.4.1. Usually the address is simply wrong. When valid addresses are rejected too, the directory is out of step: in hybrid setups an on-premises mailbox, mail-enabled public folder or dynamic distribution group may not be represented in Exchange Online. Only the recipient's admin can correct that, and Microsoft notes that changes to on-premises mailboxes can take up to 24 hours to reach the edge.
Common causes
- The address is misspelled or does not exist.
- An on-premises mailbox in a hybrid setup is not correctly synchronized to Exchange Online.
- An on-premises mail-enabled public folder or dynamic distribution group has no counterpart in Exchange Online.
- The domain was set to authoritative before every recipient existed in Exchange Online.
How to fix it
- 01Check the spelling of the recipient address and resend.
- 02Recipient admins: test whether other addresses at the domain fail too; if they all do, switch the accepted domain from Authoritative to Internal relay and back to resync it.
- 03For a single hybrid mailbox, change its SMTP proxy address to a temporary value and back to force a resync, then allow up to 24 hours.
- 04Sync on-premises mail-enabled public folders with the Sync-ModernMailPublicFolder script, and represent on-premises dynamic distribution groups with a mail contact in Exchange Online.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Fix NDR error "550 5.4.1" in Exchange Onlinelearn.microsoft.com
- Use Directory-Based Edge Blocking to reject messages sent to invalid recipients in Exchange Onlinelearn.microsoft.com
- Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
Related codes
- 5.4.1Server does not accept mail for this domain.The server that answered does not accept mail for the recipient's domain, which usually points to a wrong MX record or server setting.
- 550 5.1.10Recipient not found by SMTP address lookup.The recipient's domain is served by Exchange Online, but no recipient there has the address you sent to.
- 5.7.504Recipient address not valid.Microsoft 365 rejected the recipient address as not valid; check the address and try again.
Further reading
All 111 Microsoft codesEvery code in the wikiPaste your own bounce