Exchange Online NDR 550 5.4.1: Recipient address rejected: Access denied

Symptoms

• Sender receives an NDR containing "550 5.4.1 Recipient address rejected: Access denied"
• Can affect a single recipient, or every recipient in an accepted domain

Known error codes

• 550 5.4.1 (SMTP)

Environment / applicability

Exchange Online

Exchange Online — lifecycle: current

Diagnosis

1. Verify the recipient address: Check the exact recipient SMTP address quoted in the NDR for typos or an invalid domain.

   Expected: Confirms whether this is a simple address error rather than a directory/sync issue.

2. Determine scope: Confirm whether the NDR affects only one recipient or every recipient in the accepted domain.

   Expected: A domain-wide pattern points to an accepted-domain configuration issue rather than a single mismatched object.

Root cause

Directory-based edge blocking in Exchange Online rejects inbound mail when no valid recipient object in the tenant matches the target SMTP address. Depending on scenario this stems from: a misspelled/invalid address, an accepted-domain configuration issue, a stale hybrid recipient proxy address, an un-synced mail-enabled public folder, or an on-premises dynamic distribution group that cannot sync to Exchange Online.

Resolution

1. Resync an authoritative accepted domain: In the Exchange admin center, go to Mail flow > Accepted domains, select the domain, change its type from Authoritative to Internal Relay, save, then change it back to Authoritative.

   Expected: Forces Exchange Online to resync directory-based edge blocking for the domain.

   Warning: Only do this when the NDR affects the whole domain, not a single recipient.

2. Reset a hybrid recipient's SMTP proxy address: For a single recipient with an on-premises mailbox in a hybrid environment synced via directory sync, change the recipient's SMTP proxy address to a temporary value, sync, then change it back to the original address.

   Expected: Directory-based edge blocking updates for that recipient; allow up to 24 hours to fully propagate.

   Warning: Requires directory synchronization to be configured and functioning.

3. Sync a mail-enabled public folder (hybrid): Run the Sync-ModernMailPublicFolder PowerShell script to copy on-premises mail-enabled public folders to Exchange Online.

   Expected: The public folder becomes a valid recipient object in Exchange Online.

4. Create a mail contact for a dynamic distribution group (hybrid): Create a mail contact in Exchange Online with the same external email address as the on-premises dynamic distribution group, since dynamic distribution groups cannot sync to Exchange Online.

   Expected: Mail addressed to the group's external address now resolves to a valid Exchange Online object.

Verification

1. After applying the relevant fix and allowing propagation time, resend a test message to the affected recipient.

Rollback

The accepted-domain toggle (Authoritative -> Internal Relay -> Authoritative) and proxy-address reset are both reversible tenant configuration changes; revert to the prior value if the change does not resolve the issue.

1. Set the accepted domain type or recipient proxy address back to its original value if the change did not resolve the issue.

Risk

Risk level: Medium · Requires admin: Yes

References

• Fix error code 550 5.4.1 in Exchange Online (NDR) — Microsoft

Record metadata

ID

fx-exchange-0001

Created

2026-08-16T00:00:00Z

Updated

2026-08-16T00:00:00Z

Freshness

current