Outlook and Microsoft 365 Bounce Codes: What Each NDR Means and What to Do
An Outlook or Microsoft 365 bounce tells you why it failed in its enhanced status code: 5.1.x and 5.4.1 "Recipient address rejected" mean the address doesn't exist, 5.7.x means a block or policy decision about you, and 5.1.90, 5.2.2 or 5.7.233 mean your own account hit a sending limit. Match the code to Microsoft's NDR reference for Exchange Online, then fix the group it falls in. Only the recipient group is about your list.
To check whether an Outlook, Hotmail or Microsoft 365 address exists before you send, try it here:
Step 1: find the code in the bounce
Microsoft calls a bounce a nondelivery report (NDR). Open it and look for the "Diagnostic information for administrators" part, or the bounce record in your sending tool. You want two things: the three-digit reply (550, 451) and the enhanced code (5.1.10, 4.7.650). The first digit tells you the class: 5 is permanent, 4 is temporary.
Not sure the recipient is on Microsoft at all? Company domains on Microsoft 365 have an MX record ending in mail.protection.outlook.com. The email provider lookup shows it for any address, and our post on Hotmail, Outlook, Live and MSN domains covers the consumer side.
Step 2: match the code to its group
All texts below are quoted from Microsoft's NDR table, read 8 November 2026. Several codes have more than one wording, so match on the text as well as the number.
Group 1: the recipient doesn't exist
| Code | Microsoft's text | What to do |
|---|---|---|
| 5.1.1 | "Bad destination mailbox address" | Check for a typo, then suppress |
| 5.1.10 | "Recipient not found" | Suppress |
| 5.4.1 | "Recipient address rejected: Access denied" (Microsoft: "The recipient's address doesn't exist") | Suppress |
| 5.7.504 | "Recipient address rejected: Access denied" (Microsoft: "isn't valid") | Suppress |
| 550 5.5.0 | "Requested action not taken: mailbox unavailable", for hotmail.com or outlook.com recipients not found by address lookup | Suppress |
This is the only group a list check prevents. A mailbox check asks the receiving server about the address without sending anything, so most of these come back invalid before your campaign goes out. Our guide to verifying Outlook and Hotmail addresses explains what Microsoft does and doesn't reveal to a verifier.
One look-alike to keep apart: another 5.4.1, "Relay Access Denied", means the server that answered doesn't accept mail for that domain at all. That is usually a DNS or MX mistake on the recipient's side, not a dead mailbox.
Group 2: blocks on your IP, domain or tenant
| Code | Microsoft's text (start) | What to do |
|---|---|---|
| 5.7.606-649 | "Access denied, banned sending IP" | Fix the cause, then use Microsoft's delist portal |
| 5.7.511 | "Access denied, banned sender" (the IP) | Email [email protected] with the full NDR and IP, per Microsoft |
| 5.7.705 / 5.7.708 | "Access denied, tenant has exceeded threshold" / "traffic not accepted from this IP" | Resolve compromise or open relay, then contact support |
| 5.7.750 | "Client blocked from sending from unregistered domains" | Add and validate every domain you send from |
| 5.7.513 | "blocked by $recipientDomain using Customer Block list" | The recipient's own block list; contact them |
| 5.7.507 | "Access denied, rejected by recipient" | The recipient's organisation blocked your IP |
Our posts on 5.7.606 and 5.7.708 go through each one. Consumer Outlook.com has its own block messages, such as the S3150 block list and 5.7.515.
Group 3: authentication and message format
| Code | Microsoft's text (start) | What to do |
|---|---|---|
| 5.7.509 | "sending domain ... does not pass DMARC verification and has a DMARC policy of reject" | Fix SPF or DKIM alignment for the From domain |
| 5.7.23 | "rejected because of Sender Policy Framework violation" | Fix your SPF record |
| 5.7.512 | "message must be RFC 5322 section 3.6.2 compliant" | Send with a valid From address |
| 550 5.1.20 | "Multiple From addresses are not allowed without Sender address" | Fix how your tool builds headers |
| 5.6.11 | "Invalid characters" | Your sending program added bare line feeds |
Microsoft's requirements for high-volume senders to Outlook.com cover SPF, DKIM and DMARC. The DMARC alignment checker shows whether your From domain lines up. See also 5.7.509 explained.
Group 4: your own sending limits
| Code | Microsoft's text (start) | What to do |
|---|---|---|
| 5.1.90 | "you've reached your daily limit for message recipients" | Wait; lower daily volume per mailbox |
| 5.2.2 | "Submission quota exceeded" | Same; the recipient or message rate limit was hit |
| 5.7.233 / 5.7.232 | "your tenant exceeded its daily limit for sending email to external recipients" (232 for trial tenants) | The whole tenant is over its limit; see 5.7.233 |
| 5.7.236 | daily limit for external recipients "from your tenant's onmicrosoft.com domains" | Microsoft's table says 100 external recipients a day from onmicrosoft.com; send from your own domain |
Microsoft's table puts the per-user recipient rate limit at 10,000 recipients a day and warns that these errors can mean the account was compromised. Don't delete the recipients that bounced with these codes; the problem was your volume.
Group 5: temporary (4xx)
| Code | Microsoft's text (start) | What to do |
|---|---|---|
| 4.7.500-699 | "Access denied, please try again later" (suspicious activity) | Slow down; Microsoft says valid traffic is released shortly |
| 451 4.7.650 | Temporary block on the sending IP's reputation | See 4.7.650 |
| 4.4.7 | "Message expired" | Usually the receiving server; check the address and domain |
| 4.5.3 | "Too many recipients" (over 200 envelope recipients from one domain) | Split the message into smaller batches |
Step 3: sort a batch of bounces in this order
- Split 4xx from 5xx. Temporary codes retry on their own; if they keep coming, send less.
- Pull out 5.1.90, 5.2.2 and 5.7.23x. Those are your limits. Pause and spread volume.
- Pull out the other 5.7.x. Fix authentication first, then deal with any IP or tenant block.
- What remains in 5.1.1, 5.1.10, 5.4.1 "Recipient address rejected" and 5.5.0 is the list. Suppress those addresses and check the rest of the file before the next send.
Paste a full NDR into the bounce message analyzer if you're not sure which group it's in, or look the code up in our SMTP code pages.
Stop the recipient bounces before they happen
- Check the list before the first send and before re-mailing an old file. Upload it on the verify page: every address gets a live mailbox check, and valid, risky and invalid download as separate files.
- Expect some Microsoft consumer addresses (outlook.com, hotmail.com, live.com) to come back risky, which means unconfirmed. Send those in a smaller batch.
- For a single address, the Outlook email checker runs the same check; for Microsoft 365 company domains use the Microsoft 365 email checker.
If you're about to send cold email to a list you haven't checked, our guide on verifying a list before cold email walks through the order.
Where SimpleVerifier fits
The first 100 checks are free with a Google sign-in, no card. Starter is $9 a month for 2,500 checks; Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off. See pricing.
Common questions
What does 550 5.1.10 mean in Outlook?
Microsoft's description is 'Recipient not found': SMTP address lookup didn't find the recipient's address. The mailbox doesn't exist at that Microsoft 365 organisation. Check for a typo, then suppress the address.
What does 5.4.1 Recipient address rejected: Access denied mean?
Microsoft documents it as 'The recipient's address doesn't exist.' It comes from Directory Based Edge Blocking, which rejects unknown recipients before the message is accepted. Despite the words 'Access denied', it is about the address, not about you.
What does 550 5.7.708 mean?
'Access denied, traffic not accepted from this IP.' Microsoft says most of the traffic from the sending tenant was detected as suspicious, so its sending was restricted. It is a sender-side problem; fix any compromise or bad list, then contact support through your regular channel.
Why do I get 5.2.2 Submission quota exceeded?
Your own mailbox went over Exchange Online's recipient rate limit or message rate limit. Microsoft's NDR table puts the recipient rate limit at 10,000 recipients a day and warns the error can mean the account was compromised.
Can email verification prevent Outlook bounces?
Only the recipient bounces, such as 5.1.1, 5.1.10 and 5.4.1. Blocks, authentication failures and sending limits come from your setup and volume, which no list check changes.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.