Short answer: Microsoft 365 (Exchange Online) rejected the message at the door because it could not find the recipient in its directory. Despite the wording, "Access denied" here does not mean you are blocked; it means "this user does not exist here".
550 5.4.1 bounce message examples
The same code comes with different wording on different servers. In the bounce (non-delivery report) you may see one of these lines:
550 5.4.1 Recipient address rejected: Access denied. AS(201806281) [xxx.prod.protection.outlook.com] 550 5.4.1 Recipient address rejected: Access denied
Type: Permanent error. The sending server won't retry; fix the problem and send the message again.
What causes it?
| Cause | Explanation |
|---|---|
| User doesn't exist in Microsoft 365 | The address is wrong, or the user or alias (proxy address) is not defined in Exchange Online. |
| Directory-Based Edge Blocking (DBEB) | Microsoft rejects mail to recipients not in the directory at the network edge. This is the default when the domain is set to "Authoritative". |
| Hybrid or migrating domain | If some mailboxes still live on-premises or on another server, those users get 5.4.1 unless the domain is set to "Internal relay". |
| Newly created user | Mail may be rejected until directory synchronization completes; this normally resolves quickly. |
What to do as the sender
- Check the address for typos.
- Look up the recipient domain's MX record. If you see
*.mail.protection.outlook.com, the recipient uses Microsoft 365 and the problem is in their directory. - Forward the bounce to the recipient's IT team; there is nothing to change on your side.
What the receiving side's admin should check
- In the Microsoft 365 admin center, confirm the user or alias (proxy address) exists.
- If some mailboxes live elsewhere, set the domain to Internal relay under Exchange admin center → Mail flow → Accepted domains and configure a suitable outbound connector.
- For shared mailboxes and distribution groups, check that external senders are allowed (otherwise you will see a different 5.7.x error).
Good to know
5.4.1 behaves like Microsoft's version of the classic 5.1.1, but says less, and because of the words "Access denied" it is often mistaken for a block or blacklisting. Microsoft rejections caused by IP reputation look different: typically 550 5.7.1 with an S3150 / S3140 code, or 5.7.606–5.7.649 "banned sending IP".
Protect your inbox from spam, malware and phishing: point your MX record to Spambil and try it free for 7 days. No credit card required.
Frequently asked questions
Does 550 5.4.1 mean my IP is blacklisted?
No. It means the recipient address was not found in the receiving organization's Microsoft 365 directory. It is unrelated to IP reputation.
Mail reaches everyone else at that company except one person. Why?
Most likely that person's mailbox, or the alias you're using, isn't defined in Microsoft 365, or the user still lives on another server.