Every bounce from Microsoft 365 carries an enhanced status code such as 550 5.1.10 or 4.4.7, and that code is the fastest route to the cause. Below are the codes Microsoft documents for Exchange Online, grouped by type, with what each one means, the usual cause and the first thing to check. Press Ctrl+F, type your code and follow the guide link where there is one.
Codes in this quick reference
4.3.2 STOREDRV.Deliver; recipient thread limit exceededNDR / message trace4.4.7 Message expiredNDR4.4.316 Connection refused [Message=Socket error code 10061]NDR4.5.3 Too many recipientsNDR / SMTP response4.7.500-699 / 4.7.850-899 Access denied, please try again laterNDR4.4.317 Cannot connect to remote server [Message=UntrustedRoot]NDR4.4.8 / 5.4.8 MX hosts failed MTA-STS validationNDR4.7.5 / 5.7.5 Remote certificate failed MTA-STS validationNDR
+ 48 more codes in the tables below.
How to read these codes#
In 550 5.7.1, the SMTP reply comes first. The enhanced status code from RFC 3463 (class.subject.detail) is the part you look up. Class 4 is temporary and retried, while 5 is permanent. The middle digit narrows it down: 1 addressing, 2 mailbox, 3 mail system, 4 routing, 5 protocol, 6 content and 7 security or policy. Several codes share a number and differ only in the text, so read the whole line.
- The NDR: the admin section (More info for email admins in current NDRs, Diagnostic information for administrators in older ones) holds the technical details, including the server that rejected the message and its response. If the rejecting server isn't a Microsoft 365 server, the recipient's organization has to fix it.
- Message trace: the details of a Failed message show the same response (message trace guide).
- SMTP logs: apps and devices that send through Microsoft 365 log responses such as
5.7.57.
Text
Diagnostic information for administrators:
Generating server: <server that wrote the NDR>
<rejected recipient>
<remote server that rejected the message>
<enhanced status code> <SMTP response>Tip: the Microsoft 365 admin center also has an NDR diagnostic. Paste the code or the error text and run the test to get a suggested fix. It needs an admin account and isn't available in every cloud.
Temporary failures (4.x.x)#
Exchange Online retries these until the message expires, so many clear on their own.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
4.3.2 | STOREDRV.Deliver; recipient thread limit exceeded | Recipient mailbox throttled: too many messages too quickly | Usually clears; find what floods the mailbox |
4.4.7 | Message expired | Not delivered in time, usually a receiving-server problem | Recipient address; the receiving server's setup |
4.4.316 | Connection refused [Message=Socket error code 10061] | Network problem at the external server | The IP in the NDR shows whose server it is |
4.5.3 | Too many recipients | Over 200 envelope recipients from one domain | The sending server must split them and resend |
4.7.500-699 / 4.7.850-899 | Access denied, please try again later | Suspicious activity; sender or sending IP temporarily restricted | Valid traffic is released shortly; otherwise check for compromise |
Secure delivery: TLS, MTA-STS and DANE#
Outbound delivery to a destination that enforces TLS, MTA-STS or DANE. The 4.x.x form is retried and the 5.x.x form is final. Except for 4.4.317 in hybrid, the destination's admins usually own the fix.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
4.4.317 | Cannot connect to remote server [Message=UntrustedRoot] | Remote server sent its certificate without the full chain | Intermediate CA certificates on that server (often on-premises) |
4.4.8 / 5.4.8 | MX hosts failed MTA-STS validation | The destination's MTA-STS policy doesn't list the MX host | The recipient domain's MTA-STS policy |
4.7.5 / 5.7.5 | Remote certificate failed MTA-STS validation | Certificate untrusted or missing the policy's host name | The destination server's certificate |
4.7.321 / 5.7.321 | starttls-not-supported | No answer to STARTTLS, or the TLS handshake fails | The destination's TLS configuration |
4.7.322 / 5.7.322 | certificate-expired | The destination certificate has expired | Certificate renewal at the destination |
4.7.323 / 5.7.323 | tlsa-invalid | DANE failed: certificate doesn't match the authentic TLSA record | The destination's TLSA records and certificate |
4.7.324 / 5.7.324 | dnssec-invalid | The domain claims DNSSEC but can't be verified | The destination's DNSSEC setup |
4.7.325 / 5.7.325 | certificate-host-mismatch | Certificate names match neither the domain nor the MX host | Names on the destination certificate |
Addressing, mailbox and routing (5.0.x to 5.4.x)#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
5.0.350 | Generic error, x-dg-ref header is too long, or policy violation detected (AS345) | Catch-all from the recipient's side; Rich Text format or nested attachments | Message format; nested attachments |
5.1.0 | Sender denied | Often a reply to a saved message opened offline | Recipient address; send again |
5.1.1 | Bad destination mailbox address | Typo, removed address, or a stale cache after a mailbox move | Retype it; clear the Auto-Complete entry. Guide |
5.1.8 | Access denied, bad outbound sender | Account blocked for sending spam, usually compromised | Secure the account; Restricted entities. Guide |
5.1.10 | Recipient not found | SMTP address lookup found no recipient | Get-Recipient; accepted domain type. Guide |
5.1.20 | Multiple From addresses are not allowed without Sender address | Several From addresses and an empty Sender | The app's From and Sender headers |
5.1.90 / 5.2.2 | Daily recipient limit reached / Submission quota exceeded | Recipient or message rate limit hit; possible compromise | The sender's volume in message trace. Guide |
5.2.2 | Mailbox full (STOREDRV.Deliver QuotaExceededException) | The recipient is over its receive quota | Mailbox size; Recoverable Items. Guide |
5.2.121 / 5.2.122 | Recipient's per hour message receive limit exceeded | Too many messages an hour from one sender (121) or from all senders (122) | The mailer slows down; receiving limits report |
5.4.1 | Relay Access Denied | The server doesn't accept mail for the recipient's domain | Accepted domains; the MX record |
5.4.1 | Recipient address rejected: Access denied | Recipient not in the directory (Directory-Based Edge Blocking) | Directory sync; accepted domain type. Guide |
5.4.6 / 5.4.14 | Routing loop detected | Loop stopped after 20 iterations (5.4.6 on-premises, 5.4.14 Exchange Online) | Forwarding rules; connectors. Guide |
Protocol, content and policy (5.5.x to 5.7.x)#
Most 5.7.x codes are deliberate: a setting, policy or ban stopped the message, and the text after the code tells you which.
5.5.x and 5.6.x: protocol and content#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
5.5.0 | Requested action not taken: mailbox unavailable | An Outlook.com or Hotmail recipient wasn't found | The address. Guide |
5.6.11 | Invalid characters | The sending program added bare line feeds | Update or reconfigure the app |
5.7.x: permissions and sender restrictions#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
5.7.1 | Delivery not authorized | Group restriction, or a mail flow rule that rejects | Delivery restrictions; mail flow rules. Guide |
5.7.1 | RESOLVER.RST.AuthRequired; authentication required | External sender to a public folder that requires authentication | The public folder's mail flow settings. Guide |
5.7.12 | Sender was not authenticated by organization | Recipient rejects mail from outside its organization | The recipient's admin. Guide |
5.7.124 | Sender not in allowed-senders list | Sender missing from the group's allowed list | Group delivery management. Guide |
5.7.129 | No permission to send to the recipient | Linked to a disabled on-premises account in hybrid | How you deprovision hybrid users. Guide |
5.7.133 | Sender not authenticated for group | The group rejects outside senders | RequireSenderAuthenticationEnabled on the group. Guide |
5.7.134 | Sender was not authenticated for mailbox | The mailbox rejects outside senders | RequireSenderAuthenticationEnabled on the mailbox. Guide |
5.7.13 / 5.7.135 / 5.7.136 | Sender was not authenticated for public folder or mail user | Public folder (13, 135) or mail user (136) rejects outside senders | That recipient's delivery restrictions. Guide |
5.7.520 | Access denied, Your organization does not allow external forwarding | Outbound spam policy blocks external auto-forwarding | Automatic forwarding rules setting. Guide |
5.7.703 | Blocked by your organization using Tenant Allow Block List | A recipient or domain is blocked, so the whole message stops | Tenant Allow/Block List entries. Guide |
5.7.x: authentication, relay and sender checks#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
5.7.1 | Unable to relay | Sender lacks relay rights, or the MX points to the wrong system | MX records; accepted domains; relay rights |
5.7.1 | Client was not authenticated | The receiving system requires authentication | Receiving server's connector (often on-premises). Guide |
5.7.23 | The message was rejected because of Sender Policy Framework violation | The destination checks SPF and your record has a problem | Your SPF record. Guide |
5.7.57 | Client was not authenticated to send anonymous mail during MAIL FROM | App or device misconfigured for smtp.office365.com | SMTP AUTH or a relay connector. Guide |
5.7.64 | TenantAttribution; Relay Access Denied | An on-premises change broke the inbound connector's match | The connector's sender IPs or certificate. Guide |
5.7.367 | Remote server returned not permitted to relay | SPF or DKIM fails on forwarded or relayed mail | Gateway path; DKIM signing |
5.7.509 | Access denied, sending domain does not pass DMARC verification and has a DMARC policy of reject | The From domain fails DMARC with a reject policy | SPF, DKIM and alignment. Guide |
5.7.512 | Access denied, message must be RFC 5322 section 3.6.2 compliant | No valid From address | The app's From header |
5.7.5xx to 5.7.8xx: spam, reputation and bans#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
5.7.501 / 5.7.502 / 5.7.503 | Access denied, spam abuse detected / banned sender | Account banned for spam activity | Secure the account, then Microsoft Support. Guide |
5.7.506 | Access Denied, Bad HELO | Server greets with the receiver's name instead of its own | The sending server's HELO name |
5.7.507 | Access denied, rejected by recipient | Recipient's organization blocked your IP | Contact the recipient |
5.7.511 / 5.7.606-649 | Access denied, banned sender / banned sending IP | Your sending IP is banned by Microsoft 365 | Delisting request |
5.7.513 | Client host blocked using Customer Block list (AS16012607) | Recipient domain blocks your IP | Ask the recipient |
5.7.705 | Access denied, tenant has exceeded threshold | Tenant sending banned after suspicious traffic | Fix compromise or relay; Microsoft Support. Guide |
5.7.708 | Access denied, traffic not accepted from this IP | Low-reputation IP, mostly new or trial tenants | Microsoft Support. Guide |
5.7.750 | Client blocked from sending from unregistered domains | Volume from domains not added to the tenant | Add and verify domains. Guide |
5.7.800 | Access denied, banned sender | EHLO, P1 or P2 sender domain banned for spam | Microsoft Support |
5.7.2xx: tenant sending limits#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
5.7.232 / 5.7.233 | Tenant exceeded its daily limit for sending email to external recipients | Trial tenant (232) or tenant (233) over the rolling 24-hour limit | Find the bulk sender; wait for the count to drop |
5.7.236 | Daily limit for external recipients from onmicrosoft.com domains | Over 100 external recipients a day from onmicrosoft.com | Send from a custom domain. Guide |
How to verify a fix#
- Send again. A 4.x.x message is retried until it expires, but a 5.x.x bounce is final. After you fix the cause, the sender has to send the message again.
- Trace the new message. Good is Delivered, or Expanded for a group. If it fails again, the detail shows whether the code changed:
PowerShell
Connect-ExchangeOnline Get-MessageTraceV2 -SenderAddress adele@contoso.com -StartDate (Get-Date).AddHours(-1) -EndDate (Get-Date) | Format-Table Received, RecipientAddress, Subject, Status Get-MessageTraceV2 -SenderAddress adele@contoso.com -StartDate (Get-Date).AddHours(-1) -EndDate (Get-Date) -Status Failed | Select-Object -First 1 | Get-MessageTraceDetailV2 | Format-List Date, Event, Detail - Confirm blocks are gone. For 5.1.8,
Get-BlockedSenderAddressshould no longer list the user. Only Microsoft Support lifts tenant bans such as 5.7.705, 5.7.708 and 5.7.750, so send a test message once support closes the request. - Destination-side codes (TLS, MTA-STS, DANE, recipient policies): test again after the other organization reports its fix. The same code again means their change isn't live yet.
References#
- Email nondelivery reports and SMTP errors in Exchange Online (Microsoft Learn), the main source of the codes and descriptions on this page
- Fix NDR error codes 550 5.7.703, 550 5.7.705, 550 5.7.708, and 550 5.7.750 (Microsoft Learn)
- Fix NDR error 550 5.7.1 in Exchange Online (Microsoft Learn)
