Microsoft delivery troubleshooting
Outlook and Microsoft 365 errors, explained
Diagnose Outlook.com and Microsoft 365 SMTP rejections involving authentication, relay, routing, TLS and tenant policy.
Match the numeric code and Microsoft wording before changing DNS or connector settings.
Search troubleshooting guides
Find a guide by SMTP code, provider, or words from the error message.
Enter at least two characters.
Outlook / Microsoft 365 451 4.7.650: Temporary sending IP rate limitOutlook / Microsoft 365 451 4.7.650: Temporary sending IP rate limit. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.7.708: Traffic not accepted from IPOutlook / Microsoft 365 550 5.7.708: Traffic not accepted from IP. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 451 4.7.850: Temporary sending restrictionOutlook / Microsoft 365 451 4.7.850: Temporary sending restriction. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.1.3: Invalid recipient addressOutlook / Microsoft 365 550 5.1.3: Invalid recipient address. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.1.6: Mailbox moved without forwardingOutlook / Microsoft 365 550 5.1.6: Mailbox moved without forwarding. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.1.7: Invalid sender addressOutlook / Microsoft 365 550 5.1.7: Invalid sender address. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.1.8: Invalid sender domainOutlook / Microsoft 365 550 5.1.8: Invalid sender domain. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.2.1: Mailbox disabledOutlook / Microsoft 365 550 5.2.1: Mailbox disabled. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.2.2: Mailbox fullOutlook / Microsoft 365 550 5.2.2: Mailbox full. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.3.4: Message too largeOutlook / Microsoft 365 550 5.3.4: Message too large. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.5.3: Too many recipientsOutlook / Microsoft 365 550 5.5.3: Too many recipients. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.7.513: Recipient tenant blockOutlook / Microsoft 365 550 5.7.513: Recipient tenant block. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.7.703: Tenant Allow or Block List rejectionOutlook / Microsoft 365 550 5.7.703: Tenant Allow or Block List rejection. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.7.705: Suspicious traffic thresholdOutlook / Microsoft 365 550 5.7.705: Suspicious traffic threshold. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook / Microsoft 365 550 5.7.800: Sender or EHLO domain blockedOutlook / Microsoft 365 550 5.7.800: Sender or EHLO domain blocked. Understand the response, identify ownership, and follow an evidence-based next step.
Outlook 550 5.7.606–649: Sending IP bannedOutlook 550 5.7.606–649 means Microsoft banned the sending IP range; stop bad traffic, restore reputation, and request delisting.
Outlook 550 5.1.1: Recipient not foundOutlook 550 5.1.1 means the destination mailbox address could not be found; verify the address, avoid stale autocomplete data, and check the recipient object.
Outlook 550 5.1.10: Recipient does not existOutlook 550 5.1.10 means Microsoft could not find the recipient; verify the address and the recipient object before sending again.
Outlook 550 5.1.20: Multiple From addresses without SenderFix Outlook 550 5.1.20 by generating a valid Sender header whenever a message contains more than one address in From.
Outlook 550 5.5.0: Mailbox unavailable or invalidOutlook 550 5.5.0 reports an unavailable Outlook.com or Hotmail recipient; verify the address and stop retrying until it exists.
Outlook 550 5.7.501: Spam abuse detectedOutlook 550 5.7.501 means Microsoft banned the sending account after detecting spam activity; contain the account, reset access, and contact support.
Outlook 550 5.7.502: Sender bannedOutlook 550 5.7.502 means Microsoft banned the sending account after spam activity; secure it, correct the traffic, and contact support.
Outlook 550 5.7.503: Sender blockedOutlook 550 5.7.503 means Microsoft blocked a sending account after spam activity; contain the incident and request restoration after remediation.
Outlook 550 5.7.25: Access denied, the sending IPv6 address must have a reverse DNS recordFix Microsoft 365 550 5.7.25 when an anonymous sending IPv6 address has no reverse DNS record.
Outlook 550 5.7.511: Access denied, banned senderResolve Microsoft 550 5.7.511 by securing the sending system, correcting abusive traffic, and using Microsoft's delisting process.
Outlook 451 4.7.500-699: Access denied, please try again laterResolve Microsoft 451 4.7.500-699 by keeping slow retries and investigating the changed IP volume or suspicious sending activity.
Outlook 5.7.321: starttls-not-supported: Destination mail server must support TLS to receive mailFix Microsoft 365 5.7.321 when the destination SMTP server must support STARTTLS but does not advertise or negotiate it.
Outlook 5.7.322: certificate-expired: Destination mail server's certificate is expiredFix Microsoft 365 5.7.322 when the destination mail server presents an expired SMTP TLS certificate.
Outlook 550 5.4.1: Relay Access DeniedDiagnose Microsoft 365 550 5.4.1 relay access denied or recipient address rejected without assuming one DNS cause.
Outlook 550 5.7.23: The message was rejected because of Sender Policy Framework violationDiagnose Outlook and Exchange Online 550 5.7.23 SPF violation using the actual sender IP, MAIL FROM domain and current SPF record.
Outlook 550 5.7.506: Access Denied, Bad HELOFix Microsoft 365 and Outlook 550 5.7.506 by correcting the SMTP HELO or EHLO hostname and its DNS identity.
Outlook 550 5.7.512: Access denied, message must be RFC 5322 section 3.6.2 compliantFix Microsoft 365 550 5.7.512 when a message lacks a valid RFC 5322 From address.
Outlook 550 5.7.515: Access denied, sending domain does not meet the required authentication levelDiagnose Outlook 550 5.7.515 email rejection safely. Check SPF, DKIM and DMARC DNS, interpret the receiver report, and identify the next configuration step.
Outlook 550 5.7.520: Your organization does not allow external forwardingResolve Microsoft 550 5.7.520 when an Exchange Online outbound spam policy blocks automatic external forwarding.
Outlook 550 5.7.64: TenantAttribution; Relay Access DeniedFix Microsoft 365 550 5.7.64 by reviewing the inbound connector after an on-premises mail environment change.
Outlook 550 5.7.750: Service unavailable. Client blocked from sending from unregistered domainsResolve Microsoft 550 5.7.750 by adding and validating every sending domain used by the Microsoft 365 tenant and investigating suspicious mail volume.
Outlook 554 5.4.14: Hop count exceeded - possible mail loop ATTR34Fix Exchange Online 550 5.4.14 by tracing a routing loop across Microsoft 365, connectors, gateways, and on-premises Exchange.
Fix Microsoft 365 550 5.7.367 relay rejectionFix Microsoft 365 error 550 5.7.367 by checking the relay pool, inbound SPF or DKIM results, connectors, and the downstream relay response.
Outlook 5.7.325: certificate-host-mismatch: Remote certificate MUST have a common name or subject alternative name matching the hostname (DANE)Fix Outlook 5.7.325 by installing a certificate whose CN or SAN matches the recipient MX hostname on every destination SMTP server.
Outlook 5.7.57: Client was not authenticated to send anonymous mail during MAIL FROMFix Microsoft 365 5.7.57 by configuring the application or device to use the approved authenticated submission or relay method.
Outlook 550 5.7.323: tlsa-invalid: The domain failed DANE validationFix Outlook 550 5.7.323 by making the recipient MX certificate match its DNSSEC-authenticated TLSA record.
Outlook 550 5.7.509: Access denied, sending domain does not pass DMARC verification and has a DMARC policy of rejectFix Outlook 550 5.7.509 by making an authorized sender pass aligned SPF or DKIM without weakening a valid DMARC reject policy.
Primary sources: Microsoft Exchange Online NDR reference.