What the message looks like
550 5.4.1 Recipient address rejected: Access denied
What it means
The standard meaning of 5.4.1 is "no answer from host", but in practice you'll almost always see it from Microsoft 365 and Exchange Online. There it means the recipient address isn't a valid mailbox in that organisation, and Microsoft's servers rejected it before it reached anyone.
Microsoft does this with Directory-Based Edge Blocking, which checks every recipient against the organisation's list of users and groups.
Common causes
- A typo in the address, or the person has left the organisation.
- A new mailbox, alias or shared mailbox that hasn't been fully set up yet.
- The domain was recently moved to Microsoft 365, and some addresses haven't been added.
- Mail flow settings in that organisation that only accept certain senders.
If you're the recipient
If the address is yours, ask your IT team to check it exists in Microsoft 365 and is listed as an accepted address. New addresses can take a little while to start working.
If you're the sender
Check the address for typos and confirm it with the recipient. If it's correct, the recipient's IT team needs to fix it. There's nothing you can change on your side.
If you use addy.io
If an alias forwards to a Microsoft 365 work address and addy.io gets this error, the forward appears on your Failed Deliveries page. Check the recipient address on your addy.io account is still valid, or add a different recipient.