Every Exchange non-delivery report (NDR) and stuck queue carries a status code such as 550 5.1.1 or 451 4.4.0, and that code tells you where to start. Below are the codes Exchange Server SE, 2019 and 2016 return for common failures, from Microsoft's reference, with the usual on-premises cause and first check. Press Ctrl+F, type your code and follow the guide link where there is one.
Codes in this quick reference
4.3.1 Insufficient system resourcesNDR / queue LastError4.3.2 Service not available / Service not activeNDR / queue LastError4.4.0 DNS query failedQueue LastError4.4.1 Connection timed outNDR / queue LastError4.4.2 Connection droppedNDR / queue LastError4.4.7 Message delayed / Queue expired; message expiredNDR / delay notification5.1.0 Sender deniedNDR5.1.1 RESOLVER.ADR.ExRecipNotFound; not found / User unknownNDR
+ 30 more codes in the tables below.
How to read an Exchange status code#
In 550 5.1.1, the three-digit SMTP reply comes first (4xx: try later; 5xx: give up). The enhanced status code after it, defined in RFC 3463 as class.subject.detail, is what you look up:
- Class:
4is temporary (the sender retries);5is permanent (the message bounces). - Subject:
1addressing,2mailbox,3mail system,4network and routing,5SMTP protocol,6content or media,7security or policy. - Detail: one to three digits, so
5.7.1and5.7.900are different problems.
Where to find it:
- The NDR: open Diagnostic information for administrators. Generating server wrote the NDR; a remote server listed under the recipient refused the message during the SMTP session, and Exchange passes its response through unchanged.
- Queues: 4.x.x failures wait in a Retry queue; Queue Viewer and
Get-Queueshow the response inLastError. By default the sender gets a delay notice after 4 hours and an NDR when the message expires after 2 days (DelayNotificationTimeout,MessageExpirationTimeoutonSet-TransportService). - Message tracking:
FAILevents hold the code inRecipientStatus(tracking guide).
Text
Diagnostic information for administrators:
Generating server: EX01.contoso.com
jane@fabrikam.com
Remote Server returned '550 5.1.1 User unknown'PowerShell
# Retry queues on this server
Get-Queue | Where-Object Status -eq 'Retry' | Format-List Identity,NextHopDomain,MessageCount,LastError
# Failures in the last 24 hours, all transport servers
Get-TransportService | Get-MessageTrackingLog -EventId FAIL -Start (Get-Date).AddHours(-24) -ResultSize Unlimited |
Select-Object Timestamp,Sender,Recipients,RecipientStatusTemporary failures (4.x.x)#
Exchange retries these: fix the cause, then retry the queue.
| Code | What it means | Usual on-premises cause | First check |
|---|---|---|---|
4.3.1 | Insufficient system resources | Back pressure: low disk space on the queue database drive, or low memory (avoid dynamic memory on VMs) | Queue drive free space; Get-ExchangeDiagnosticInfo -Process EdgeTransport -Component ResourceThrottling. Guide |
4.3.2 | Service not available / Service not active | Inactive components, a custom port 25 receive connector in the Transport service instead of Front End Transport, or an incompatible transport agent | Get-ServerComponentState -Identity EX01; connector TransportRole; Get-TransportAgent. Guide |
4.4.0 | DNS query failed | Transport's DNS servers (the network adapter's by default) don't answer, or a remote domain's DNS mishandles AAAA queries | Get-TransportService | Format-List Name,ExternalDNS*,InternalDNS*; Resolve-DnsName fabrikam.com -Type MX. Guide |
4.4.1 | Connection timed out | Outbound port 25 blocked by a firewall or ISP, or the destination or smart host is down | Test-NetConnection mx.fabrikam.com -Port 25 from the server. Guide |
4.4.2 | Connection dropped | Session cut by a receiving-side size or rate limit, or by an antispam appliance, SMTP proxy or firewall | SmtpSend protocol log; firewall SMTP inspection. Guide |
4.4.7 | Message delayed / Queue expired; message expired | Expired after failed retries: wrong DNS vs smart host routing, a connector FQDN not matching your MX name, Mailbox Transport Delivery stopped at the destination, TNEF trouble there, or your SPF record missing a source | Get-SendConnector | Format-List Name,DNSRoutingEnabled,SmartHosts,Fqdn. Guide |
5.1.x: addressing#
| Code | What it means | Usual on-premises cause | First check |
|---|---|---|---|
5.1.0 | Sender denied | Replies to old or saved messages, broken contacts, or sender filtering (including Blocked Senders via safelist aggregation) | Pick the recipient again; Get-SenderFilterConfig |
5.1.1 | RESOLVER.ADR.ExRecipNotFound; not found / User unknown | The address doesn't exist, or a re-created mailbox meets stale autocomplete entries (old X.500 / LegacyExchangeDN) | Get-Recipient jane@contoso.com; an IMCEAEX address means a missing X500 proxy. Guide |
5.1.3 | STOREDRV.Submit; invalid recipient address | Unsupported characters or bad formatting in the address | The exact address in the NDR or app |
5.1.4 | Recipient address reserved by RFC 2606 | Reserved top-level domain (.test, .example, .invalid, .localhost) | Receive connector RejectReservedTopLevelRecipientDomains |
5.1.5 | Recipient address reserved by RFC 2606 | Reserved second-level domain (example.com, example.net, example.org) | Receive connector RejectReservedSecondLevelRecipientDomains |
5.1.6 | Recipient addresses in single label domains not accepted | An address like chris@contoso with no top-level domain | Receive connector RejectSingleLabelRecipientDomains |
5.1.7 | Invalid address / Unknown sender address | Wrong or malformed sender (MAIL FROM) address, typically from an app | The app's From address |
5.1.8 | Access denied, bad outbound sender | A message rate limit was exceeded, typically by an app server relaying bulk mail | MessageRateLimit on the app's receive connector |
5.2.x: mailbox#
| Code | What it means | Usual on-premises cause | First check |
|---|---|---|---|
5.2.1 | Content Filter agent quarantined this message | Content filtering rated it as spam and quarantined it | Get-ContentFilterConfig; exceptions with Set-ContentFilterConfig |
5.2.2 | Mailbox full | The recipient is over the quota that blocks receiving | Get-MailboxStatistics jane | Format-List TotalItemSize; ProhibitSendReceiveQuota |
5.2.3 | RESOLVER.RST.RecipSizeLimit; message too large for this recipient | Bigger than the recipient's own size limit | MaxReceiveSize on the mailbox or group. Guide |
5.3.x: mail system#
| Code | What it means | Usual on-premises cause | First check |
|---|---|---|---|
5.3.0 | Too many related errors | Judged malformed and moved to the poison message queue | Get-Message -Queue EX01\Poison. Guide |
5.3.2 | STOREDRV.Deliver: Missing or bad StoreDriver MDB properties | ABP Routing agent enabled, and the recipient isn't in their address book policy's GAL | Get-Mailbox jane | Format-List AddressBookPolicy |
5.3.3 | Unrecognized command | A receive connector carrying internal mail lacks Exchange Server authentication | Get-ReceiveConnector | Format-Table Name,AuthMechanism |
5.3.4 | Message size exceeds fixed maximum message size | Over a size limit on the route: organization, connector or remote system | Get-TransportConfig | Format-List MaxSendSize,MaxReceiveSize; connector MaxMessageSize. Guide |
5.3.5 | System incorrectly configured | Mail loop: a receive connector's FQDN matches another server, service or device in your mail flow | Get-ReceiveConnector | Format-Table Name,Fqdn |
5.4.x: network and routing#
| Code | What it means | Usual on-premises cause | First check |
|---|---|---|---|
5.4.4 | SMTPSEND.DNS.NonExistentDomain; nonexistent domain | A DNS or network adapter problem on the Exchange server, or a mistyped domain | DNS settings on Get-TransportService and Get-FrontEndTransportService; adapter priority. Guide |
5.4.6 | Hop count exceeded - possible mail loop | A loop, stopped after 20 hops by default: Inbox or forwarding rules, a targetAddress on a mailbox, or routing changes | Get-InboxRule -Mailbox jane; forwarding; restart both transport services after routing changes. Guide |
5.5.x and 5.6.x: protocol and content#
Microsoft's Exchange Server list has no common 5.6.x codes; content problems appear as 5.2.1, 5.3.0 or a mail flow rule code.
| Code | What it means | Usual on-premises cause | First check |
|---|---|---|---|
5.5.2 | Send hello first | The client sent AUTH or MAIL FROM before EHLO/HELO | Receive protocol log; the app's SMTP library |
5.5.3 | Too many recipients | To, Cc and Bcc exceed the organization, connector or sender limit | MaxRecipientEnvelopeLimit, connector MaxRecipientsPerMessage, mailbox RecipientLimits |
5.7.x: security and policy#
Read the text after 5.7.1: it has three meanings. 5.7.54 isn't in Microsoft's NDR reference; its wording below is the SMTP response admins report from Exchange 2016 and 2019 servers.
| Code | What it means | Usual on-premises cause | First check |
|---|---|---|---|
5.7.1 | Unable to relay | An app or device relays to external recipients through a connector that doesn't allow it | Which connector answered (protocol log); a relay connector scoped by RemoteIPRanges. Guide |
5.7.1 | Client was not authenticated | Anonymous SMTP where sign-in is required: Default Frontend lost AnonymousUsers, or an app uses port 587 without authenticating | Get-ReceiveConnector "EX01\Default Frontend EX01" | Format-List PermissionGroups. Guide |
5.7.1 | Delivery not authorized, message refused | The recipient accepts only authenticated or listed senders, or a mail flow rule rejected it with the default code | RequireSenderAuthenticationEnabled, AcceptMessagesOnlyFrom*; mail flow rules |
5.7.3 | Cannot achieve Exchange Server authentication / Not Authorized | A firewall strips the X-EXPS command servers authenticate with, or internal traffic hits a custom connector lacking Exchange Server authentication | Custom connectors' RemoteIPRanges; SMTP inspection between servers |
5.7.54 | Unable to relay recipient in non-accepted domain | Anonymous relay to an outside domain without ms-Exch-SMTP-Accept-Any-Recipient, or inbound mail for a non-accepted domain | Get-AcceptedDomain; relay connector permissions. Guide |
5.7.900-5.7.999 | Delivery not authorized, message refused | A mail flow rule rejected it with a custom code from this range | Get-TransportRule | Format-Table Name,State,RejectMessageEnhancedStatusCode |
Hybrid: codes from Exchange Online#
In hybrid, Exchange Online writes some NDRs (check the generating server). These codes are most tied to on-premises setup; use message trace plus on-premises tracking.
| Code | What it means | Usual cause | First check |
|---|---|---|---|
4.4.317 | Cannot connect to remote server [Message=UntrustedRoot] | Your server sent its certificate without the full chain, so Exchange Online couldn't validate it | Intermediate CA certificates on every server receiving from Exchange Online |
5.1.10 | Recipient not found | No such address in Exchange Online, for example a cloud mailbox lacking the tenant.mail.onmicrosoft.com address on-premises routes to | Get-RemoteMailbox jane | Format-List RemoteRoutingAddress. Guide |
5.3.190 | Journaling on-premises messages to Microsoft 365 or Office 365 not supported when Journaling Archive is disabled | An on-premises journal rule targets Microsoft 365 while Journaling Archive is off | Get-JournalRule |
5.4.1 | Recipient address rejected: Access denied / Relay Access Denied | Directory-Based Edge Blocking: the recipient isn't in Exchange Online's directory (not synced, or the domain should be Internal Relay). Relay Access Denied: the domain isn't accepted there | Accepted domain type in Exchange Online; directory sync. Guide |
5.4.14 | Routing loop detected | A loop caught by Exchange Online (on-premises reports 5.4.6), for example a recipient each side routes to the other | Message trace plus on-premises tracking; RemoteRoutingAddress. Guide |
5.7.64 | TenantAttribution; Relay Access Denied | The inbound connector from on-premises no longer matches your servers after a change such as a new IP or certificate | Get-InboundConnector | Format-List SenderIPAddresses,TlsSenderCertificateName. Guide |
How to test after a fix#
- Retry now:
Retry-Queue -Filter "Status -eq 'Retry'" -Server EX01. Good: the queue drains andLastErrorclears. - Server to server: in a shell connected to EX01, run
Test-Mailflow -Identity EX01 -TargetMailboxServer EX02; good isTestMailflowResult : Success. - Replay SMTP: Microsoft marks
Send-MailMessageobsolete (it can't guarantee a secure connection), so from the failing machine runTest-NetConnection mail.contoso.com -Port 25(good:TcpTestSucceeded : True), then a manual Telnet session (Install-WindowsFeature Telnet-Client) and check the server's SMTP protocol log. - Track it: send from a test mailbox or the Telnet session; good is
RECEIVEthenDELIVER(local mailbox) orSEND(next hop), with no newFAIL.
Text
telnet mail.contoso.com 25
220 EX01.contoso.com Microsoft ESMTP MAIL Service ready at ...
EHLO test.fabrikam.com
250-EX01.contoso.com Hello [203.0.113.25]
...
MAIL FROM:<tester@fabrikam.com>
250 2.1.0 Sender OK
RCPT TO:<jane@contoso.com>
250 2.1.5 Recipient OK
DATA
354 Start mail input; end with <CRLF>.<CRLF>
Subject: test
.
250 2.6.0 <message-id> [InternalId=...] Queued mail for delivery
QUITPowerShell
Get-TransportService | Get-MessageTrackingLog -Sender tester@fabrikam.com -Start (Get-Date).AddMinutes(-30) |
Sort-Object Timestamp | Format-Table Timestamp,EventId,Source,RecipientsReferences#
- DSNs and NDRs in Exchange Server (Microsoft Learn)
- 451 4.4.0 DNS query failed Exchange Server error in message queue (Microsoft Learn)
- Email nondelivery reports and SMTP errors in Exchange Online (Microsoft Learn)
- Message retry, resubmit, and expiration intervals in Exchange Server (Microsoft Learn)
