Microsoft 365 SMTP error guide

SMTP 550 5.4.1: Microsoft 365 recipient lookup or relay error

In Exchange Online, 550 5.4.1 usually means Directory-Based Edge Blocking rejected the recipient, or a connector/relay route is denied. Check the diagnostic text before suppressing the address or retrying.

Quick summary

Primary code
550 5.4.1
Provider coverage
Microsoft
Primary action
Suppress recipient

How to handle 550 5.4.1

Start by matching the provider wording, then use the matching section below. The same SMTP code can call for different actions depending on whether it points to recipient validity, routing, sender setup, or policy.

Microsoft mail servers 550 5.4.1

Recipient issue

Suppress recipient

Microsoft 365 can reject the address during Directory-Based Edge Blocking when the recipient is not present in the accepted domain or tenant directory.

Directory-Based Edge Blocking can expose invalid recipients as 5.4.1.

Decision

Suppress this recipient. A retry is unlikely to help.

Confidence: high. Recipient validity: invalid.

Match this reply

SMTP stage
RCPT TO recipient check
Endpoint
Inbound MX
Recipient address rejected: Access denied

Start here

  1. 1

    Confirm the recipient address and domain are spelled correctly.

  2. 2

    Suppress the recipient only when the provider-specific evidence says the mailbox is invalid.

Confirm the cause

  1. Validate the recipient address, then confirm the mailbox, alias, group, shared mailbox, or contact exists in Microsoft 365.
  2. Confirm the recipient domain is an accepted domain in the tenant and that Directory-Based Edge Blocking is expected.
  3. Compare the envelope recipient with the visible To/Cc address; suppress only the bounced recipient address.

App handling

  • Classify as a hard bounce only when this provider-specific fingerprint matches.
  • Stop retries for the bounced recipient and keep the raw SMTP reply for audit and support.
  • Do not suppress other recipients in the same send unless they return their own matching bounce.

Avoid

  • Do not suppress from the numeric code alone. Confirm the provider, SMTP stage, and diagnostic text first.
  • Do not keep retrying once the provider-specific evidence says the mailbox is invalid.
  • Do not apply this suppression decision to the same code from another provider without matching that provider's text.
Common causes
  • The RCPT TO address is not present as a valid recipient in the Microsoft 365 tenant directory.
  • The mailbox, alias, group, shared mailbox, or mail contact is missing, disabled, or not mail-enabled.
  • Directory-Based Edge Blocking rejected the address before the message reached a mailbox.
Developer details
Fields to log
raw SMTP replyremote MX or hostSMTP stagereply codeenhanced codeprovidermatched rule idrecipientsending domaindecisiontimestampenvelope recipientcontact id
Classifier evidence
Specific cause
invalid recipient dbeb
Evidence
official+observed
learn.microsoft.com source 1

Microsoft mail servers 550 5.4.1

Routing

Fix sender setup

The receiving service refused the route, connector, or relay path. The recipient may still be valid, so fix routing before making a suppression decision.

Do not merge with DBEB invalid-recipient form.

Decision

Do not retry unchanged. Fix the sender setup first.

Confidence: high. Recipient validity: unknown.

Match this reply

SMTP stage
RCPT TO recipient check
Endpoint
Inbound MX
Relay Access DeniedUnable to relay

Start here

  1. 1

    Check MX records, forwarding paths, and connector configuration for loops or relay denial.

  2. 2

    Retry only after the routing path has been corrected.

Confirm the cause

  1. Confirm the SMTP client is sending to the correct MX host or SMTP relay for the destination.
  2. Review connector scoping: source IP, TLS certificate, sender domain, accepted domain, and relay permission.
  3. Send one single-recipient test message after correcting the route; do not retry the full batch unchanged.

App handling

  • Treat this as a sender setup incident, not a bad recipient.
  • Hold similar mail for the same sender domain or provider until the fix is verified.
  • Retry after a fresh single-recipient test succeeds.

Avoid

  • Do not retry unchanged in a loop.
  • Do not suppress the recipient unless the text explicitly says the mailbox is invalid.
  • Do not treat a permanent SMTP code as proof that the address is bad; policy and routing failures can also be permanent.
Common causes
  • The SMTP client connected to an MX or relay that does not accept this sender, recipient, or route.
  • Connector rules do not match the source IP, TLS certificate, sender domain, or accepted domain.
  • Mail routing points to the provider, but the receiving tenant does not authorize this delivery path.
Developer details
Fields to log
raw SMTP replyremote MX or hostSMTP stagereply codeenhanced codeprovidermatched rule idrecipientsending domaindecisiontimestampsource IPconnectorTLS result
Classifier evidence
Specific cause
relay or connector denied
Evidence
official+observed
learn.microsoft.com source 1

Not sure this is the right match?

Paste the full SMTP reply into the lookup tool. The classifier uses provider, endpoint, SMTP stage, reply code, enhanced code, token, and diagnostic text.

Open lookup tool