clement
Try free for 14 days

550 5.4.1: Recipient address rejected: Access denied (Microsoft)

Microsoft 365's edge rejected the address because it isn't a valid recipient in that organization (or the server won't relay for that domain).

Bounce type
Hard bounce (permanent)
What to do
Suppress the address
Returned by
Microsoft (Outlook.com, Microsoft 365)

What 550 5.4.1 means

Microsoft documents two meanings for 5.4.1. 'Recipient address rejected: Access denied' means the recipient address doesn't exist: the receiving organization uses Directory Based Edge Blocking, so Microsoft 365 rejects unknown addresses at the edge before the message is even accepted. 'Relay Access Denied' means the server doesn't accept mail for the recipient's domain at all, usually because of a mail server or DNS misconfiguration.

For cold email to companies on Microsoft 365, the first form is by far the most common. Treat it exactly like 'user unknown'.

What the bounce looks like

The wording providers document for this code. Your bounce may add an IP address, a session ID or a help link after it.

Microsoft
550 5.4.1 Recipient address rejected: Access denied.

Usually followed by an internal reference like AS(201806281).

Microsoft
550 5.4.1 Relay Access Denied

Why cold emailers see 550 5.4.1

  • The address doesn't exist in the recipient's Microsoft 365 tenant (left the company, wrong format, made-up data).
  • Relay variant: the domain's MX points at Microsoft 365 but the domain isn't set up there as an accepted domain.

How to fix 550 5.4.1

  1. For 'Recipient address rejected: Access denied', suppress the address.
  2. For 'Relay Access Denied', check the recipient domain's MX records; if it's misconfigured, there's nothing you can fix from your side. Try again later or reach the contact another way.
  3. Re-verify other contacts at the same company; a bounce like this often means the company changed its address format.

Retry or suppress?

Suppress for 'Recipient address rejected'. These count as hard bounces, so a cluster of them hurts your reputation.

Reading the code

The basic code 550 means "Mailbox unavailable or message refused (permanent)" under RFC 5321. In 5.4.1, the 5 is the class (permanent failure) and the 4 is the subject (network and routing). The detail number 1 is registered in RFC 3463 / the IANA registry as "No answer from host".

Class 5
Permanent failure
Resending the same message won't work. Something about the message, the recipient or the sender has to change first.
Subject 4
Network and routing
A problem with networking, DNS or routing between servers.
Detail 5.4.1
No answer from host

Check the rest of your setup

Paste the headers of a message that did get through into the email header analyzer to confirm SPF, DKIM and DMARC pass, and check your domain with the SPF, DKIM & DMARC checker. The deliverability checklist covers the rest of a healthy sending setup.

Got a different bounce? Paste it into the SMTP error code lookup to decode it.

FAQ

Is 550 5.4.1 a hard bounce or a soft bounce?

550 5.4.1 is a permanent failure (a hard bounce): the receiving server won't accept this message if you send it again unchanged. Here the problem is the address itself.

Should I remove the contact after a 550 5.4.1 bounce?

Yes. Suppress for 'Recipient address rejected'. These count as hard bounces, so a cluster of them hurts your reputation.

What does 5.4.1 mean in the error code?

In 5.4.1, the 5 is the class (permanent failure) and the 4 is the subject (network and routing). The detail number 1 is registered in RFC 3463 / the IANA registry as "No answer from host".

Related SMTP codes

See all SMTP error codes

Sources

Try Clement free for 14 days

Clement reads the bounces that land in your Gmail and SMTP inboxes and tells dead addresses apart from policy blocks: it suppresses the first across every campaign and keeps the contact on the second, so you don't have to decode bounces by hand.

Start free trial