SPF, DKIM and DMARC all pass but you’re still getting 550 5.4.1 bounces? You’re probably debugging the wrong thing

saw this confuse a lot of people so here’s the short version.

if you get bounces like “550 5.4.1 Recipient address rejected: Access denied” going to Microsoft 365 domains, and your authentication is all green, the problem usually isn’t your setup. it’s a directory rejection on the receiving side. the connection works fine, the message gets handed over, and then the address just doesn’t exist in their directory.

this is different from 550 5.7.1, which is about reputation or filtering policy. with 5.4.1 your warmup, your IP and your DNS records are irrelevant. people waste days on that.

what usually causes it:

• mailbox deleted or never existed. most common by far. someone left the company, or the address was a typo or old CRM import.
• domain misconfigured on their end. if it hits every address at one domain and not just one, that’s a clue. in hybrid setups the accepted domain is sometimes set to Authoritative while some mailboxes still live on an on-prem server, so Exchange Online rejects perfectly valid addresses.
• DBEB (Directory-Based Edge Blocking). Exchange Online rejects unknown addresses at the edge before any spam filtering. if the NDR has that “AS(201806281)” tag, it’s this.
• dead alias or distribution list. a deleted alias or a disabled group gives you the exact same error.

quick triage: is it one address or the whole domain? one address means it’s dead, remove it. whole domain means it’s probably their config, and the fix is on their side, not yours.

the part people forget is that every one of these counts as a hard bounce on your stats, even though none of them are your fault. stack enough of them on a list and your sender reputation takes the hit anyway. most sending tools only check that the address is formatted correctly, not that the mailbox still exists.

how do you guys handle these? do you auto-suppress on any 5.x.x or look at the codes individually? and has anyone actually run into the Authoritative vs Internal Relay thing from the sending side?

source : captain verify blog