550 5.4.1 Recipient Address Rejected: Access Denied Fix

550 5.4.1 Recipient address rejected: Access denied means the recipient's Microsoft 365 tenant has no record of the address you sent to. Exchange Online checked it against the organisation's directory, found nothing, and rejected the message at its front door. It is a permanent failure and, in most cases, it is not caused by anything on your side.

The check is called Directory-Based Edge Blocking (DBEB). It runs before anti-malware, anti-spam and mail flow rules, which is why your SPF, DKIM and sender reputation have no bearing on this particular bounce. Microsoft's own fix steps are written for the recipient's email administrator, not for you.

Below: how to read the bounce (including the AS(201806281) tag), the causes, what you can do as the sender, and the exact steps the recipient's admin needs.

What does the 550 5.4.1 bounce actually say?#

A typical bounce from Microsoft 365 contains a line like the one below. The host name ending in protection.outlook.com tells you the rejection came from Exchange Online Protection, Microsoft's mail gateway, rather than from your own mail server.

550 is the SMTP reply for a permanent failure, so your server will not retry. 5.4.1 is an enhanced status code from RFC 3463, where the standard meaning is "no answer from host". Microsoft reuses the code for its own recipient check, which is why the number alone is confusing. The text after it is what matters.

What does AS(201806281) mean?#

AS(201806281) is a diagnostic tag that Exchange Online appends to the rejection. Microsoft does not publish a definition for it, so treat it as a fingerprint rather than a separate error. It shows up on the same Directory-Based Edge Blocking rejections described here, across many unrelated tenants.

What it does not mean is that your domain or IP address is blocked. Reputation and authentication blocks from Microsoft come back with their own 5.7.x codes. If you see AS(201806281) next to 550 5.4.1 Recipient address rejected, the problem is the recipient address, and the fix list below applies unchanged.

The causes of 550 5.4.1 recipient address rejected#

Each cause leaves a different pattern. Spotting the pattern before you contact anyone means the right person starts on the right fix.

Who has to fix it: you or the recipient's admin?#

Almost always the recipient's admin. Only someone with access to their Exchange admin centre can add a mailbox, change an accepted domain or repair directory sync. Your part is narrower but still useful: rule out a typo, stop resending, and get the bounce to the right person.

What to do if you are the sender#

1. 1

   Check the address

   Compare the address in the bounce with the one the person gave you. Transposed letters, an old company domain and a missing middle initial cause a large share of these bounces.

2. 2

   Send a short test to another address at the same domain

   Use a colleague's address or a general one such as info@. If that delivers, the domain is healthy and only this mailbox is missing. If it bounces with the same 550 5.4.1, the domain is misconfigured on their side.

3. 3

   Stop sending to the address

   Remove it from any sequence or mailing list. A 550 is permanent, so every retry produces another bounce and, on a marketing platform, counts against your list health.

4. 4

   Reach the person or their IT team another way

   Use a phone number, the company website or a mutual contact. Ask whether the address has changed, and forward the full bounce to whoever runs their Microsoft 365.

5. 5

   Paste this message

   Hi, mail I send to [address] bounces with "550 5.4.1 Recipient address rejected: Access denied" from Exchange Online. Microsoft documents this as Directory-Based Edge Blocking not finding the address in your tenant. Could your Microsoft 365 admin check whether the mailbox exists and is synced? The full bounce is attached.

How the recipient's Microsoft 365 admin fixes 550 5.4.1#

These steps follow Microsoft's troubleshooting article for the error (updated October 2026). Work down the list until mail delivers.

1. 1

   Confirm the spelling and the scope

   Check the address in the bounce, then test whether other recipients in the same domain also bounce. One recipient points to a missing or unsynced object. Every recipient points to the accepted domain.

2. 2

   If the whole domain bounces, resync the accepted domain

   In the Exchange admin centre, open Mail flow > Accepted domains and select the domain. Switch the domain type from Authoritative to Internal relay, save, then switch it back to Authoritative.

3. 3

   If one hybrid user bounces, reset their SMTP proxy address

   For an on-premises mailbox synced to Microsoft Entra ID, change the proxy address to a temporary value and then back to the original. Allow up to 24 hours for DBEB to fully update after changes to on-premises mailboxes.

4. 4

   If it is an on-premises mail-enabled public folder

   Check that the folder exists in Exchange Online. If it does not, run Microsoft's Sync-ModernMailPublicFolder script to copy on-premises mail-enabled public folders to Exchange Online.

5. 5

   If it is an on-premises dynamic distribution group

   These groups cannot sync to Exchange Online. Create a mail contact in Exchange Online with the same external email address as the group, so DBEB recognises the address.

6. 6

   Check the MX record in a hybrid setup

   DBEB only works when the domain's MX record points to Microsoft 365, so mail reaches Exchange Online first. If the bounce persists and the MX points elsewhere, the rejection may be coming from another gateway passing Microsoft's answer back.

Can SPF, DKIM or DMARC cause 550 5.4.1?#

Not this wording. Microsoft states that DBEB blocks the message before filtering even occurs, and authentication is part of that later filtering. A sender that fails SPF, DKIM or DMARC at Microsoft 365 gets a different code, typically in the 5.7.x range, such as 550 5.7.509 for a DMARC reject.

So fixing your DNS records will not clear a Recipient address rejected bounce. If you see both kinds of bounce from the same organisation, treat them as two problems: the 5.4.1 is about their directory, the 5.7.x is about your domain.

How to tell which cause applies#

Three questions narrow it down in a couple of minutes.

First, what does the text say? Relay Access Denied points to the domain's MX or DNS setup, which this article's fix list does not cover. Recipient address rejected: Access denied is DBEB, and everything above applies.

Second, does another address at the domain deliver? If yes, the problem is this one mailbox: a typo, a deleted account or an unsynced hybrid object. If no, the accepted domain is misconfigured or its DBEB data is stale.

Third, has this address ever worked for you? If it delivered last month and broke this week, something changed in their tenant, often a departure or a migration step. If it never delivered, check the spelling again before assuming the mailbox is missing.

Preventing 550 5.4.1 bounces#

You cannot prevent the cause, because it lives inside someone else's tenant. You can limit the damage. Treat every 550 5.4.1 as a hard bounce the moment it arrives, and suppress the address until someone confirms it works again.

Watch for patterns by domain. One bounce at a company is usually one person who left. Several contacts at the same company bouncing on the same day is almost always an admin change on their side, and one forwarded bounce to their IT contact fixes it for everyone.

The slow part of this bounce is the follow-up: noticing it among the day's mail, finding the right contact, and writing a message their admin can act on. AI Emaily drafts that reply from the bounce thread, and in Copilot mode nothing is sent until you approve it. It works across Gmail, Outlook and IMAP accounts. We build AI Emaily; it will not fix the recipient's directory, only the time you spend chasing it.