Microsoft DSN / Bounce Codes – Complete Glossary (with Fixes)

Purpose: a single place to decode Microsoft (Outlook/Hotmail/Office 365 / Exchange Online) DSN/SMTP errors and apply the right fix. Use alongside the Deliverability Fix‑Kit tutorial.

How to use:

  1. Find the exact code in your NDR / bounce (e.g., 550 5.7.1, SC‑004, 4.7.650, 5.7.57).
  2. Jump to the matching entry below.
  3. Apply the remedy steps, then re‑test and (for Microsoft policy blocks) file an unblock at sender.office.com after remediation.

⚠️ Note: This glossary reflects widely observed codes and behaviors as of our last update. Microsoft periodically adds/changes codes; we’ll expand this list with tester samples. Also consult Microsoft Learn: Exchange Online NDRs and SMTP error codes.

Quick Links

Policy & Reputation Blocks

SC‑001 / SC‑002 / SC‑004 — Microsoft policy block

Symptom: NDR cites an SC‑code; mail blocked due to sender reputation/policy. Root causes: High complaints, spamtrap hits, poor IP/domain reputation, authentication failures. Fix:

  • PTR ↔ EHLO exact match; SPF trimmed; DKIM present and valid; DMARC aligned (pass).
  • Reduce complaint rate (<0.1%), stop questionable sends, clean lists.
  • Per‑destination throttles for Outlook/Hotmail (lower concurrency & rate).
  • When fixed, request unblock at https://sender.office.com/ (see tutorial’s unblock template).

550 5.7.1 — Access denied, spam policy / content

Symptom: Immediate block; often includes policy text. Root causes: Content/reputation triggers, alignment failures, bad forwarders. Fix: Ensure SPF/DKIM/DMARC pass, enable ARC + SRS for forwarding, clean lists, then request delist if persistent.

550 5.7.501 — Access denied, banned sending IP

Symptom: IP reputation block. Fix: Check Microsoft SNDS for color/traps; remediate abuse/compromise, request delist at sender.office.com.

550 5.7.606 / 550 5.7.607 — Access denied by recipient policy

Symptom: Recipient org policy blocked the message/sender. Fix: Sender must be allowed by recipient (or their admin). For broad impact, improve reputation and submit unblock; for single tenant, ask recipient admin to review their allow/block lists.

Throttling & Rate Limits

421 4.7.0 — Temporary block / throttling

Symptom: Deferrals; retries may eventually succeed. Root causes: Rate/concurrency too high, reputation rehabilitation in progress. Fix: Use Postfix transport slow lane for Microsoft; reduce concurrency and recipients per connection; smooth cadence.

4.7.650 — Rate limits exceeded to Outlook endpoints

Symptom: Temp failure citing rate limits. Fix: Lower parallelism; add backoff; warm up gradually.

4.7.500 — Temporary policy failure

Symptom: Temp failure before content is accepted. Fix: Treat as a signal to slow down; re‑test with smaller batches; ensure TLS/auth expectations are met.

Authentication / Connector Problems

550 5.7.57 — Client not authenticated / anonymous mail not permitted

Symptom: "Client was not authenticated to send anonymous mail during MAIL FROM" (or similar). Root causes: Misconfigured connector/relay; sending without auth where auth is required. Fix:

  • Use Submission (587) with SMTP AUTH for mailbox sends, or
  • Configure an Exchange Online connector that trusts your sending IP (with TLS + cert) for server‑to‑server relays.

5.7.64 — Relay not permitted / tenant attribution

Symptom: Service won’t relay for the sender. Fix: Ensure the sender domain belongs to your tenant; configure connector scoping correctly; send with auth if needed.

5.7.708 — Access denied due to org or security policy

Symptom: Policy forbids the attempted auth or path. Fix: Use supported auth path (Submission/Modern Auth) or correct the connector; remove legacy/anonymous paths unless explicitly allowed.

Recipient / Addressing Issues

550 5.1.1 — User unknown

Fix: Verify address, typos, aliases; ask recipient to confirm mailbox exists.

550 5.1.10 — Recipient not found / ambiguous

Fix: Recipient directory mismatch; confirm correct address/alias; for hybrid, sync directories.

550 5.4.1 — Recipient address rejected: Access denied

Fix: Recipient policy prohibits sender/domain; recipient admin must allow or adjust mail flow rules.

550 5.4.6 — Routing loop detected

Fix: Check MX and connector routing; fix forwarding loops and mis‑scoped connectors.

550 5.4.14 — Hop count exceeded

Fix: Trace via Received: headers; remove loops; reduce multi‑hop routing.

Mailbox & Content Limits

552 5.2.2 — Mailbox full

Fix: Recipient must free space or admin must raise quota.

552 5.2.3 — Message too large

Fix: Reduce size (attachments), or ask admin to raise limits; observe O365 per‑message limits.

5.6.0 / 5.6.3 — Media/content conversion problems

Fix: Remove malformed MIME/HTML; avoid exotic encodings; send a plain‑text test.

User Blocklist (Per‑recipient)

5.7.750 – 5.7.760 — Blocked by user or admin (UserBlockList)

Symptom: Recipient’s block list or tenant policy blocked you. Fix: Recipient must remove the block or their admin must allow the sender/domain/IP; provide Message‑ID and time for their investigation.

Transient Network & DNS

4.4.1 — Connection timed out

Fix: Remote service unreachable; check network/DNS/firewall; retry later.

4.4.2 — Bad connection / unable to route

Fix: DNS or network path issue; verify MX, A/AAAA, TLS reachability.

4.3.1 — Insufficient system storage (remote)

Fix: Remote system out of resources; retry later; nothing to fix on sender side.

General RFC Enhanced Status Codes (Reference)

(For completeness; Microsoft uses these with additional text.)

  • 2.x.x — Success
  • 4.x.x — Persistent transient failure (retry)
  • 5.x.x — Permanent failure (don’t auto‑retry without changes)

Common families

  • 5.1.x — Addressing (bad user/domain)
  • 5.2.x — Mailbox/full/size
  • 5.3.x — System status
  • 5.4.x — Routing/network
  • 5.5.x — Protocol/command
  • 5.6.x — Content/media
  • 5.7.x — Policy/security/authentication

Verification & Next Steps

  • After each change, send a new test and inspect headers (Authentication‑Results).
  • Monitor SNDS color and JMRP complaints; for Gmail use Postmaster reputation.
  • For persistent Microsoft blocks after remediation, submit sender.office.com with the polite template from the tutorial.

Related Tutorials

Credible Sources

Got an NDR that isn’t listed here? Add it to our issue tracker with the exact error text and headers so we can include it and its fix.