Skip to content
notspoofed.comSPF · DKIM · DMARC

Microsoft 5.4.1: relay access denied

By · Published

Hard bounceYour problemMicrosoft 365 / Exchange Online

The error

550 5.4.1 Recipient address rejected: Access denied

550 5.4.1 [recipient@example.com]: Recipient address rejected: Access denied

What it means

Microsoft returns 5.4.1 for two different situations: the recipient address does not exist in the destination tenant, or the receiving system does not accept mail for that domain at all.

Something about the message or the address you sent to needs changing.

Why it happens

The second case is usually a mail-flow misconfiguration — an MX record pointing at a system that was never set up to accept that domain, often left behind after a migration.

How to fix it

  1. Check the recipient address for a typo; this is the common case by a wide margin.
  2. If the address is definitely right, ask the recipient whether their domain is fully set up in Microsoft 365.
  3. If you own the receiving domain, confirm the accepted domains and MX records point where you expect.

Official documentation: Microsoft: fix error code 5.4.1.

Related guides

  • Microsoft 5.7.23: SPF violation — The receiving Microsoft system checked your SPF record and the sending IP was not authorised by it.
  • Microsoft 5.7.606: banned sending IP — Microsoft has blocklisted the IP you are sending from. The codes 5.7.606 through 5.7.649 all mean the same thing; the varying number identifies which internal list caught it.
  • TLS and DANE validation bounces — Microsoft would not deliver because the destination’s TLS setup failed validation — no STARTTLS, an expired certificate, a hostname mismatch, or a failing DANE or DNSSEC record.