Does 550 5.4.1 mean my domain is blocked or my email is spam?

No. Both documented versions are about the recipient address or domain, not about your reputation or content. Fixing SPF, DKIM or DMARC won't change this bounce; the receiving tenant is refusing the address before it looks at your message.

Should I retry later?

Not unchanged. 5.4.1 is a permanent rejection and the server will give the same answer until the address or the tenant configuration changes. If the recipient's admin has just created the mailbox or fixed directory sync, a resend after that change will work.

Why do colleagues inside the company receive mail at that address but outside senders get 5.4.1?

Internal mail can route differently from mail arriving at the edge from the internet. Directory Based Edge Blocking applies to inbound mail from outside, so an address that only exists in an on-premises directory, or on another system behind an Authoritative domain, can work internally and still be refused for external senders.

Microsoft 365 / Outlook

Microsoft 365 550 5.4.1 — "Recipient address rejected: Access denied"

550 5.4.1

Microsoft documents two versions of 550 5.4.1, and the text after the code tells you which one you have. "Recipient address rejected: Access denied" is the common one: the recipient's Microsoft 365 tenant uses Directory Based Edge Blocking, which refuses mail at the edge for any address that isn't in its directory, so the message never reached a mailbox. "Relay Access Denied" means the server that answered doesn't accept mail for the recipient's domain at all, which points to a mail server or DNS misconfiguration on the receiving side. In both cases the problem is on the recipient's end, not your sending reputation or authentication.

How to fix it

1
Read the full bounce text first
Paste the bounce into the bounce analyzer or open the NDR's technical details. "Recipient address rejected: Access denied" (often followed by an AS(…) reference number) is the directory check. "Relay Access Denied" is a domain-level routing problem. The fixes below differ completely between the two.
2
Check the address itself
Most "Access denied" bounces are a mistyped, deleted or renamed address: a person who left the company, a mailbox converted to a different alias, or an old address that never existed in the new tenant after a migration. Confirm the exact address with the recipient through another channel before resending.
3
If you're the recipient's admin and the address is real
Directory Based Edge Blocking only accepts addresses Exchange Online knows about. A mailbox created minutes ago, a user not yet synced from on-premises Active Directory, or a proxy address that was never added will all be rejected. Check that the address appears on the user, group or shared mailbox in the Exchange admin center, and wait for directory sync if you run a hybrid setup.
4
If some mailboxes still live on another system
When a domain is shared between Microsoft 365 and another mail server (a hybrid setup or a staged migration), set that accepted domain to Internal relay instead of Authoritative. Authoritative tells Exchange Online that every valid address is in its own directory, so mail for mailboxes hosted elsewhere is rejected with 5.4.1.
5
For "Relay Access Denied": check the domain's MX and accepted domains
This version usually means the domain's MX record points at Exchange Online but the domain isn't (or is no longer) an accepted domain in that tenant, for example after a tenant move or a removed domain. Run the MX lookup on the recipient domain and confirm that the tenant the MX points to actually lists the domain.

Meaning current as of 2026-10-24, cross-checked against the provider's own documentation. Providers do occasionally redefine codes — if this doesn't match what you're seeing, the source link is the authoritative reference.

How to fix it

Common questions