What Does 550 5.4.1 Mean, and How Do I Fix It?

What the bounce says

550 5.4.1 Recipient address rejected: Access denied comes from Exchange Online, the mail service behind Microsoft 365. Microsoft's NDR article for this code says the bounce is generated when Directory-Based Edge Blocking (DBEB) "blocks an incoming email message because the recipient's email address is invalid."

DBEB works at the edge of the service. Per Microsoft's DBEB page, a valid address goes on to anti-malware, anti-spam and mail flow rules, while for an address that doesn't exist "the service blocks the message before filtering even occurs." The same page says DBEB is already on for every domain whose recipients all live in Exchange Online.

So this bounce says nothing about your copy, your links or your sender reputation. The spam filter never saw the message. Gmail does not use this code: 5.4.1 is not in Google's SMTP error list.

The texts that come with 5.4.1

Microsoft's NDR reference lists two texts under 5.4.1 and one close neighbor:

The first and third mean the same thing for a sender: the mailbox is not there. The second one is a routing problem on the receiving side, covered with 554 5.7.1 in 550 5.7.1.

What it means for a cold email list

A 5.4.1 is a hard bounce on a bad address. On a prospect list the usual reasons are a person who left the company, an address guessed from a first.last pattern, or a typo in the export. The email bounce decoder confirms the code and text if the bounce is long.

Then count by recipient domain. Microsoft's own first check for the recipient's admin is whether "the issue affects only one recipient or everyone in the recipient's domain." One address at a company means that address is dead. Every address at one company means the domain itself is not taking mail for those users.

Microsoft lists the domain-wide causes, and all of them sit on the recipient's side: an accepted domain that needs a resync, or a hybrid setup where on-premises users or dynamic distribution groups are not synced to Exchange Online. After a change on an on-premises mailbox, Microsoft says to "allow up to 24 hours" for DBEB to update. You can't fix any of this as the sender.

What to do

1. Copy the full bounce. Check that the code is 5.4.1 and the text is "Recipient address rejected".

2. Compare the address. Make sure the address in the bounce is the one in your list, with no stray characters.

3. Remove it everywhere. Take it out of every campaign, sequence and CRM list. A permanent 5xx will come back on every retry.

4. Check the domain if all addresses fail. Look up its MX with MX lookup. Microsoft's 5.1.x article says an Exchange Online domain's MX points to <domain>.mail.protection.outlook.com. If the company still runs Microsoft 365 and every address bounces, pause sends to that domain.

5. Clean the rest of the list. The email list cleaner removes duplicates, invalid, role and free-mail addresses. It does not check whether a mailbox exists, so run the list through an email verifier before the next send.

6. Watch the bounce rate. If 5.4.1 and 5.1.1 together are a visible share of a send, the list is the problem. See bounce rate too high and 550 5.1.1.

Questions

Is 550 5.4.1 a block on my domain?

No. Microsoft rejects the message for the recipient address before its anti-spam filtering runs, so the bounce does not reflect your domain or IP reputation. If Microsoft 365 is refusing your sender, the codes are different, for example 5.7.1 "blocked using Blocklist 1" or 5.7.515 for failed authentication. See Outlook blocking cold email.

Can I resend after a 550 5.4.1?

Only after you correct a typo you found in the address. Microsoft's fixes for this code are all in the recipient's tenant, so the same message to the same address will bounce again until their admin changes something.

What we recommend at Outreach2day

Outreach2day analytics shows warmup inbox, spam and bounce rate for every mailbox and splits sends by recipient provider: Google Workspace, Microsoft 365 and others. If warmup bounces stay low while a campaign collects 5.4.1 on Microsoft 365 recipients, the cause is the list.