Microsoft 365 5.4.1
Relay Access Denied / Recipient address rejected: Access denied
Microsoft 365 5.4.1 means: relay Access Denied / Recipient address rejected: Access denied. It is a permanent failure, so do not retry it unchanged. Stop sending from the affected account or IP until the cause is fixed. Check for a compromised account, and remove unverified and unengaged addresses before you resume.
Microsoft 365’s exact wording
Quoted from Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online, checked 2026-11-05. Placeholders are Microsoft 365’s own.
Provider's description
Relay Access Denied
Possible cause
The mail server that's generating the error doesn't accept mail for the recipient's domain. Mail server or DNS misconfiguration causes this error.
Provider's description
Recipient address rejected: Access denied
Possible cause
The recipient's address doesn't exist.
| Who sends it | Microsoft 365, Exchange Online and Outlook.com |
|---|---|
| Basic code | Microsoft 365 lists the enhanced code only |
| Enhanced code | 5.4.1: No answer from host |
| Permanent or temporary | Permanent (5xx) |
| Verifying the list prevents it | Partly |
In practice
Microsoft documents two different 5.4.1 replies. Relay Access Denied means the server that rejected the message does not accept mail for that domain, usually because of MX or connector misconfiguration on the recipient side. Recipient address rejected: Access denied comes from Directory Based Edge Blocking, which rejects addresses not in the tenant's directory, and is in practice a hard bounce. If you see the Access denied version for every address at a domain, the tenant may be rejecting unknown recipients with an edge block.
What the sender should do
Stop sending from the affected account or IP until the cause is fixed. Check for a compromised account, and remove unverified and unengaged addresses before you resume.
Would verifying the list have prevented Microsoft 365 5.4.1?
Partly
The reply is not only about one address, but providers weigh how often a sender hits addresses that do not exist. Removing bad addresses before sending lowers that signal.
Common questions
- What does Microsoft 365 5.4.1 mean?
- Microsoft 365 5.4.1 means: relay Access Denied / Recipient address rejected: Access denied. It is a permanent failure, so do not retry it unchanged. Stop sending from the affected account or IP until the cause is fixed. Check for a compromised account, and remove unverified and unengaged addresses before you resume.
- Should I retry after Microsoft 365 5.4.1?
- No. It is a permanent (5xx) failure, so the same message to the same address will fail again. Fix the cause first. Stop sending from the affected account or IP until the cause is fixed. Check for a compromised account, and remove unverified and unengaged addresses before you resume.
- Would verifying my list have prevented Microsoft 365 5.4.1?
- Partly. The reply is not only about one address, but providers weigh how often a sender hits addresses that do not exist. Removing bad addresses before sending lowers that signal.
Sources
- Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online (checked 2026-11-05)
- IANA: SMTP Enhanced Status Codes registry (checked 2026-11-05)
Registry and provider wording is quoted exactly; guidance is written by the SimpleVerifier Team.
SimpleVerifier Team · Last checked against the sources 2026-11-05