550 5.4.1 Recipient address rejected: Access denied
Despite the wording, Microsoft's 550 5.4.1 "Access denied" means the recipient address doesn't exist in that organization. It's a list problem, not a block.
What 550 5.4.1 means
550 5.4.1 Recipient address rejected: Access deniedThe address doesn't exist in the recipient's Microsoft 365 organization.
550 5.4.1 Relay Access DeniedA different case: the server doesn't accept mail for the recipient's domain, usually a mail server or DNS (MX) problem on their side.
List problem or sender problem?
List problem. Microsoft's own table says this text means the address doesn't exist: the receiving Microsoft 365 organization turns away recipients it doesn't have. "Access denied" makes it look like a block, but your domain wasn't judged. It's a permanent failure: the server won't accept this message if you send it again unchanged.
How to fix 550 5.4.1
- Treat "Access denied" as a dead address: confirm it another way and remove it from your list.
- Don't retry it, and don't swap in new inboxes: nothing about your domain caused it.
- For "Relay Access Denied", check the recipient domain's MX records. If they're wrong, only that domain's admin can fix them.
In SendingOS, a 550 5.4.1 bounce shows its reason and code on the conversation, and the thread is labelled Bounced, so you can filter the inbox to bounces and pull these addresses before they add up.
Not sure whether a spike in bounces is the list or the domain? Read High email bounce rate? Burned domain or bad list.
Related codes
Sources: Microsoft: NDRs in Exchange Online
Questions
Does 550 5.4.1 mean Microsoft blocked me?
Not when the text is "Recipient address rejected: Access denied". Microsoft documents that as a recipient address that doesn't exist. Microsoft blocks come with other codes, like 5.7.511 (banned sender) or a 5.7.1 that names a block list.