What it looks like in your logs
550 5.4.1 Recipient address rejected: Access denied. [BN8NAM11FT012.eop-nam11.prod.protection.outlook.com 2026-09-15T10:22:31.000Z]What does 5.4.1 mean?
The registry assigns X.4.1 to "no answer from host", a network condition. Microsoft uses 5.4.1 for something unrelated: Exchange Online Protection returns "550 5.4.1 Recipient address rejected: Access denied" when the destination tenant will not accept that recipient. It also appears as "Relay access denied" when a server will not relay for you. When the text says access denied, go by the Microsoft meaning.
The most common trigger is directory-based edge blocking. Microsoft checks the recipient against the tenant's directory at the edge and rejects addresses that are not listed. So 5.4.1 often means the address does not exist, but it can also mean it exists and is restricted, for example a group or shared mailbox set to accept mail only from authenticated internal senders.
That second case is invisible from outside. Internal colleagues can mail the address, external senders all bounce. If a recipient insists their address works, ask their admin to check the delivery restrictions on that mailbox or group.
Soft or hard bounce?
| Soft bounce (4xx) | Hard bounce (5xx) | |
|---|---|---|
| Nature | Temporary | Permanent |
| Sender behaviour | Queue and retry with backoff | Stop, suppress the address |
| Reputation risk | Low, unless it repeats for days | High above a 2% bounce rate |
| 5.4.1 | ✓ this code |
Common causes
- The address does not exist in the recipient tenant and directory-based edge blocking rejected it.
- A distribution group or shared mailbox accepts mail only from authenticated internal senders.
- A mail flow rule at the destination blocks your domain or address.
- The recipient organization restricts inbound mail to an allow list of senders.
- You tried to relay through a server that does not authorize you (relay access denied).
How to fix 5.4.1
- Check the spelling of the recipient address and confirm it with the recipient through another channel.
- If the address is a group or shared mailbox, ask the recipient admin to allow external senders or add your domain as permitted.
- Ask the admin to look for mail flow rules or tenant block entries that match your domain.
- If the text says relay access denied, authenticate to your relay and confirm your sending domain is registered with it.
- If the address really does not exist, suppress it as you would a 5.1.1.
5.4.1 questions
What does 550 5.4.1 recipient address rejected access denied mean?
It means Microsoft 365 refused the recipient on behalf of the destination organization. Most often the address is not in their directory. Sometimes it exists but is configured to reject external mail, which is common for distribution groups and shared mailboxes.
The recipient says their address works. Why am I rejected?
It probably only works for internal senders. Groups and shared mailboxes in Microsoft 365 can require sender authentication, which blocks everyone outside the organization. Ask the recipient admin to check the delivery management settings for that address. Share the full bounce text so they can see the exact rejection.
Why does the registry say 5.4.1 means no answer from host?
Because that is the official meaning of X.4.1. Microsoft reuses the code for recipient rejections, and the two uses have nothing in common. If the text mentions access denied, follow the Microsoft meaning. If you see a temporary 4.4.1, it is the network meaning.
Should I remove 5.4.1 addresses from my list?
If the address is misspelled or the person has left, yes. If it is a valid group or shared mailbox that blocks external senders, suppress it for marketing mail and use another route for anything important until the recipient changes the setting.