Microsoft 365 "550 5.4.1 Recipient address rejected: Access denied. AS(201806281)": what it means and how to fix it

What it means

The recipient's organization uses Microsoft 365. Its servers checked the address you wrote to and found that it does not exist in their directory, so they refused the email before even accepting it. The bounce usually looks like this:

550 5.4.1 Recipient address rejected: Access denied. AS(201806281)
[DB5EUR03FT012.eop-EUR03.prod.protection.outlook.com]

The server name in brackets varies. Despite the words "Access denied", this is not about your reputation, your IP or your authentication. It means "this address is unknown here".

Why it happens

Microsoft 365 uses a feature called Directory-Based Edge Blocking: it rejects any email for an address that is not listed in the organization's directory. Common reasons:

• A typo in the address, or an old address of someone who left the company.
• The mailbox, alias or group was deleted or never created.
• A new mailbox is not ready yet, or a user created in an on-premises directory has not synchronised to Microsoft 365.
• The domain is set up wrongly in the recipient tenant: in a hybrid setup, or when some mailboxes are hosted elsewhere, the domain should be set as "Internal relay" rather than "Authoritative".
• The domain's MX still points to Microsoft 365 after the company moved its email to another provider.

How to check

If you are the sender

• Check the spelling of the address, letter by letter, and compare it with a recent email from that person.
• Look at the domain on /domain-scanner: the MX records show where the domain receives email. If they point to Microsoft 365 but the company says they use another provider, their DNS is out of date.
• Make sure your own setup is fine by sending a test to the unique address on the Delivmail home page (/). If it arrives and the report is clean, the problem is on the recipient side.

If you administer the receiving organization

• Search for the address in the Microsoft 365 admin center, including aliases (proxy addresses), groups and shared mailboxes.
• Check the accepted domain type in the Exchange admin center.
• Check directory synchronisation if you use an on-premises Active Directory.

How to fix it

1. Sender: correct the address, or ask the person for their current address by phone or another channel. You cannot fix this from your side if the address does not exist.
2. Recipient admin: create the missing address as a mailbox, alias, group or mail contact, depending on who should receive it.
3. Fix synchronisation so the user appears in Microsoft 365, then wait for the next sync.
4. Change the domain to Internal relay if some addresses of the domain are hosted on another system, and set up the matching outbound connector.
5. Update the MX records if the domain no longer uses Microsoft 365 for email.

Check that it is fixed

Once the address has been created or corrected, wait a little (directory changes can take up to an hour, DNS changes can take a few hours), then send the email again. If it still bounces with the same code, ask the recipient's IT team to check the address directly in their admin center.