DE EN IT

~/errors / SMTP / Mail

SMTP: 550 5.4.1 Recipient address rejected: Access denied

This bounce comes from Exchange Online when it protects itself against address harvesting. The mail is refused at the edge because it cannot find the recipient in the directory. It looks like a permission problem, but it nearly always means the address does not exist there.

daniele@mikweb: ~/errors — less smtp-550-5-4-1-recipient-address-rejected-access-denied.md

What the message looks like

550 5.4.1 Recipient address rejected: Access denied. AS(201806281) [DB3EUR04FT012.eop-eur04.prod.protection.outlook.com]

Common causes

  • The recipient address has a typo, or the person or alias was removed or never created.
  • The domain is set to "Internal Relay" in Exchange Online, but the mailbox lives on another server, and no connector sends the mail on.
  • The mailbox was just created or renamed, and the change has not spread yet.
  • The MX of the domain points to Microsoft 365, but the mailboxes are hosted somewhere else, for example after a migration.
  • For a distribution group, it accepts only authenticated senders, or the group was deleted.

Check

  1. Where does the MX of the recipient domain point?
    dig +short MX example.com
  2. Find the bounce in your own Postfix log
    journalctl -u postfix --since today --no-pager | grep ' 5.4.1 ' | tail -n 10
  3. Does the recipient exist in the tenant? (Exchange Online PowerShell, as admin)
    Get-Recipient user@example.com | Format-List PrimarySmtpAddress,RecipientType
  4. What type is the accepted domain? (Exchange Online PowerShell, as admin)
    Get-AcceptedDomain | Format-Table DomainName,DomainType

Fix

  • Check the address letter by letter with the recipient, and test with the primary address.
  • If the mailbox or alias is missing, create it or add the address to the right user. Wait a short time for it to spread.
  • If mailboxes are still on-premises, set the accepted domain to Internal Relay and create the outbound connector, or keep the domain Authoritative when all mailboxes are in Exchange Online.
  • After a migration, move the MX record to the system that now holds the mailboxes.
  • Send the test again from outside and compare the new bounce, if any.

FAQ

How is this different from 550 5.1.1?

5.1.1 says the user is unknown. 5.4.1 with Access denied is the answer of Exchange Online's directory-based edge blocking, which also hides whether an address exists. The cause is still, most of the time, that the recipient is not found.

Can the sender fix this alone?

The sender can check the spelling and ask the recipient to confirm the address. If the address is right, only the recipient's admin can fix it in the tenant.

daniele@mikweb: ~/blog — ls

Related articles

Mail landing in spam: SPF, DKIM and DMARC alignment explainedSPF, DKIM and DMARC explained simply: what each checks, why mail lands in spam although SPF passes, how to read headers — with a table and checklist.DNS migration without downtime: TTL, order of steps and a checklist for domain and hosting movesSwitch hosting or DNS provider without losing website or e-mail: lower the TTL, export the zone instead of retyping it, test before the cutover.
daniele@mikweb: ~/errors — ls

More errors

550 5.7.1SMTP 550 5.7.1: relay access denied and policy rejections550 5.7.26SMTP 550 5.7.26 and 5.7.23: unauthenticated email421 4.7.0SMTP 421 4.7.0: temporarily rate limited, try again later554 5.7.1SMTP 554 5.7.1: rejected due to blocklist or spammail for example.com loops back to myselfPostfix: mail for example.com loops back to myself450 4.1.8 Sender address rejected: Domain not foundSMTP: 450 4.1.8 Sender address rejected: Domain not found

New articles by e-mail

One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).

← All error codes