Is 550 5.4.1 permanent or temporary?

550 5.4.1 is a permanent (5.x.x) failure — the server will not accept the message as-is, and retrying without changing anything won't help. You need to fix the underlying cause.

Is this my problem or the recipient's?

It depends on the cause — the recipient mailbox doesn't exist is the most common. Work through the causes below to find which applies to you.

How do I check my sending setup?

Run a free EmailHealth check on your domain — it verifies SPF, DKIM, DMARC, blacklist status, and more in a couple of seconds, which covers the most common causes of delivery failures.

550 5.4.1 — Recipient address rejected: Access denied (Office 365)

550 5.4.1 is a permanent SMTP reply meaning recipient address rejected: access denied (office 365). Microsoft uses 5.4.1 for both non-existent recipients and policy blocks. It means the recipient server will not accept mail for that address from your sender.

What 550 5.4.1 means

Microsoft uses 5.4.1 for both non-existent recipients and policy blocks. It means the recipient server will not accept mail for that address from your sender.

⚠️

This is a 5.x.x permanent failure — the message will keep bouncing until you fix the cause. Retrying the same message unchanged won't help.

Common causes

📨

The recipient mailbox doesn't exist

Most common

The address is wrong, deactivated, or a directory entry without a real mailbox. Common after staff changes.

🔁

A tenant policy blocks external or unauthenticated senders

Common

The recipient's Microsoft 365 admin restricts who can email a mailbox or distribution list, and you're outside the allowed set.

⚙️

Directory-based edge blocking

Less common

Exchange Online Protection rejects addresses not in the recipient's directory before they reach the mailbox.

How to fix 550 5.4.1

1
Confirm the address is correct and active
Verify spelling and that the mailbox still exists. For a single contact, ask them to confirm their address.
2
Ask the recipient to allowlist you
If a tenant policy is blocking you, the recipient's IT admin must add your domain/address to the allowed senders or relax the restriction.
3
Make sure you're authenticated
Passing SPF, DKIM, and DMARC reduces the chance Microsoft treats you as an untrusted external sender. Verify with a free check.

Confirm your domain is set up correctly

Most delivery failures — permanent or temporary — trace back to authentication or reputation. Run a free EmailHealth check to confirm SPF, DKIM, DMARC, blacklist status, and TLS are all healthy for your sending domain. If you send in volume, free daily monitoring will alert you before a small issue becomes a flood of bounces.

Recipient address rejected: Access denied (Office 365)