Fix Common Exchange Online NDR Bounce Errors

Short answer

Start with the enhanced status code in the NDR, then run a message trace to see where the message failed. Most Exchange Online bounces trace back to a few causes: a recipient that does not exist (5.1.1, 5.1.10, 5.4.1), a delivery restriction or mail flow rule (5.7.1), SPF or DMARC failures (5.7.23, 5.7.509), a device failing SMTP AUTH (5.7.57), or a destination server that never accepted the message (4.4.7).

Key facts

A 5.x.x enhanced status code is a permanent error and a 4.x.x code is a temporary error.
Exchange Online retries delivery for 24 hours before it sends a 4.4.7 Message expired NDR.
Directory-Based Edge Blocking rejects mail to unknown addresses with 550 5.4.1 Recipient address rejected: Access denied.
Message trace in the new EAC searches up to 90 days, but only 10 days of data per query.
Get-MessageTraceV2 replaces Get-MessageTrace, which Microsoft says will eventually be deprecated.
In Exchange Online, 5.2.2 means Submission quota exceeded (the sender hit a sending limit), not a full recipient mailbox.

How to read an Exchange Online NDR

The current NDR format has three parts. The fix-it owner indicator shows whether the sender, Microsoft 365, or the recipient side has to fix the issue. How to fix it is written for the user. More info for email admins gives the technical detail and a link to the reference article.

Older-format NDRs split this into User information and Diagnostic information for administrators. The admin section lists the generating server, each rejected recipient, the remote server that rejected the message, the enhanced status code, the SMTP response, and the original message headers.

Generating server: the server that created the NDR. If no remote server is listed, it is also the server that rejected the message.
Remote server: the server that rejected the message. If it is not a Microsoft 365 server, the fix is usually on the other side.
Enhanced status code: the abc x.y.z value (for example 550 5.1.10). This is what you look up.
Original message headers: show the path the message took and whether the To value matches the rejected recipient.

Prerequisites and permissions

Exchange Administrator role in Microsoft Entra ID, or membership in the Organization Management role group in Exchange Online. Microsoft recommends the least-privileged role, so avoid Global Administrator for routine tracing.
The ExchangeOnlineManagement PowerShell module. Get-MessageTraceV2 needs version 3.7.0 or later.
Access to the Exchange admin center at https://admin.exchange.microsoft.com and the Microsoft 365 admin center.
The NDR itself, or at least the sender, recipient, approximate send time and status code.

Install or update the module and connect

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser
Update-Module -Name ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName [email protected]

Step 1: Run a message trace in the new EAC

Open the Exchange admin center at https://admin.exchange.microsoft.com and go to Exchange admin center > Mail flow > Message trace.
Select Start a trace. The default is all senders and recipients for the last 2 days.
Enter the sender in Senders and the address that bounced in Recipients. External addresses and a single wildcard (for example *@contoso.com) are allowed.
Set Time range. Up to 10 days returns an instant Summary report. Longer ranges (up to 90 days) produce a downloadable Enhanced summary or Extended report that can take hours.
Optionally open Detailed search options and set Delivery status to Failed, or paste the Message ID from the NDR headers.
Select Search, then select the message row to open the details flyout.
Expand Message events and look for Fail or Defer events and the error text. Expand More information to see the To IP the service tried to deliver to.

Step 2: Trace the message with Get-MessageTraceV2

Use Get-MessageTraceV2, not Get-MessageTrace. The V2 cmdlet searches up to 90 days, returns only the last 48 hours if you give no parameters, allows 10 days per query, and returns 1,000 results by default (5,000 maximum with -ResultSize). Pagination is gone: to get the next batch, reuse the last result's Received time as -EndDate and its recipient as -StartingRecipientAddress. Throttling allows 100 queries per 5 minutes per tenant.

# Find failed messages from one sender, then show event detail
Get-MessageTraceV2 -SenderAddress [email protected] -StartDate 10/14/2026 -EndDate 10/21/2026 -Status Failed |
  Format-Table Received,SenderAddress,RecipientAddress,Subject,Status

Get-MessageTraceV2 -SenderAddress [email protected] -RecipientAddress [email protected] -StartDate 10/14/2026 -EndDate 10/21/2026 |
  Get-MessageTraceDetailV2

# Get the next round of results (no pagination in V2)
$mt = Get-MessageTraceV2 -SenderAddress [email protected] -ResultSize 5000
$next = Get-MessageTraceV2 -SenderAddress [email protected] -ResultSize 5000 -EndDate $mt[-1].Received.ToString("O") -StartingRecipientAddress $mt[-1].RecipientAddress

Common Exchange Online NDR codes and fixes

These codes and causes come from Microsoft's Email nondelivery reports and SMTP errors in Exchange Online page and its child articles.

Code	Meaning	Likely cause	Fix
5.1.1	Bad destination mailbox address	Typo, address no longer exists, or a stale Outlook recipient cache entry after a mailbox move	Check the address. Have the sender delete the Auto-Complete entry and create a new message; resending the original fails again.
5.1.10	Recipient not found	SMTP address lookup found no recipient. It can also be backscatter from a spoofed From address	Confirm the recipient exists and is licensed, fix broken forwarding (Inbox rules, account forwarding, redirect mail flow rules), check accepted domain type and MX record.
5.4.1	Recipient address rejected: Access denied	Directory-Based Edge Blocking: the address does not exist in Exchange Online	Create the mailbox, mail user or contact, or sync it from on-premises. During migrations keep the domain on Internal relay until all recipients exist.
5.4.1	Relay Access Denied	The server does not accept mail for the recipient's domain (mail server or DNS misconfiguration)	Check the MX record and that the domain is an accepted domain in the tenant.
5.7.1	Delivery not authorized	Sender is not allowed to send to the recipient, often a group limited to members or authorized senders, or a mail flow rule rejected it	Add the sender to the group's allowed senders (external senders need a mail contact or mail user), allow external senders, or adjust the mail flow rule.
5.7.1	Unable to relay / Client was not authenticated	Anonymous relay to a domain the server does not accept, a wrong MX record, or a sender that did not authenticate	Fix the MX record or accepted domain, or configure the sending system to authenticate.
5.7.23	Rejected because of Sender Policy Framework violation	Your SPF record is incomplete, the domain is unprovisioned, or outbound mail went through the High Risk Delivery Pool	Add all sending sources (including on-premises IPs) to SPF, provision all your domains, and check whether outbound mail was flagged as spam.
5.7.57	Client was not authenticated to send anonymous mail during MAIL FROM	An app or device relaying through smtp.office365.com has wrong credentials or cannot negotiate TLS	Correct the credentials (a user with an Exchange Online mailbox), confirm TLS works, and confirm SMTP AUTH is enabled for that mailbox.
5.7.509	Sending domain does not pass DMARC verification and has a DMARC policy of reject	The 5322.From domain failed DMARC: missing or misaligned SPF or DKIM, or forwarding broke them	Use the NDR and headers to find which check failed, then add or align SPF and DKIM for that domain.
5.7.705 / 5.7.708	Tenant has exceeded threshold / traffic not accepted from this IP	Most traffic from the tenant was detected as suspicious, so its sending was banned	Resolve compromised accounts and open relays, then contact Microsoft support.
5.2.2	Submission quota exceeded	The sender exceeded the recipient rate or message rate limit	Check the account for compromise, then reduce volume and wait for the limit window.
4.4.7	Message expired	The destination server was offline, refused the message, had DNS or MX problems, or timed out for 24 hours	Have the destination check MX and anti-spam blocks. On your side run the Outbound SMTP Email test, check SPF, domain expiry and hybrid connectors.

PowerShell checks by error type

Run these after Connect-ExchangeOnline. Microsoft recommends Get-EXORecipient and Get-EXOMailboxStatistics in Exchange Online for performance, but the classic cmdlets below still work.

# 5.1.1 / 5.1.10 / 5.4.1: does the recipient exist, and what type is it?
Get-Recipient -Identity [email protected] | Format-List Name,RecipientType,RecipientTypeDetails,EmailAddresses
Get-MailboxStatistics -Identity [email protected]

# 5.1.10 / 5.4.1: check accepted domain type (Authoritative or InternalRelay)
Get-AcceptedDomain | Format-Table Name,DomainName,DomainType

# 5.7.1: look for mail flow rules and group sender restrictions
Get-TransportRule -State Enabled | Format-Table Name,State,Priority
Get-TransportRule "Block external to Finance" | Format-List
Get-DistributionGroup -Identity [email protected] |
  Format-List RequireSenderAuthenticationEnabled,AcceptMessagesOnlyFromSendersOrMembers

# 5.7.1: let external senders reach a distribution group
Set-DistributionGroup -Identity [email protected] -RequireSenderAuthenticationEnabled $false

# 5.7.57: check and enable SMTP AUTH for one device mailbox
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
Get-CASMailbox -Identity [email protected] | Format-List SmtpClientAuthenticationDisabled
Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $false

Fixing 5.7.57 and SMTP AUTH in the admin center

Microsoft recommends leaving SMTP AUTH off for the organization and turning it on only for the mailboxes that need it. The per-mailbox setting overrides the org setting. If security defaults are on, SMTP AUTH is already disabled. If an authentication policy blocks Basic authentication for SMTP, the device cannot use SMTP AUTH even with these settings on. SMTP AUTH supports OAuth as well as Basic authentication.

Open the Microsoft 365 admin center and go to Users > Active users.
Select the mailbox the device signs in with, then select Mail.
In Email apps, select Manage email apps.
Check Authenticated SMTP, then select Save changes.
On the device, confirm the credentials and that it can negotiate TLS (SMTP AUTH submission typically uses TCP port 587).

Fixing 5.1.10 and 5.4.1 recipient errors

In the Microsoft 365 admin center go to Users > Active users, find the recipient, and confirm it has a license that includes Exchange Online.
On the user's Mail tab, check Email forwarding and turn it off if it points to a bad address.
In the Exchange admin center go to Mail flow > Rules and fix or disable any redirect rule that sends mail to a dead address.
Go to Mail flow > Accepted domains and check the domain type. Authoritative rejects unknown recipients. Internal relay passes them to on-premises and needs a connector.
For hybrid recipients, confirm the on-premises object has synced to Exchange Online through Microsoft Entra Connect Sync, then recheck.
In the Microsoft 365 admin center go to Settings > Domains, select the domain, and use Check DNS. Microsoft supports only one MX record for a domain enrolled in Exchange Online.

How to verify the fix worked

Send a fresh test message (for 5.1.1, a new message, not the old one resent) and confirm no NDR comes back.
In Exchange admin center > Mail flow > Message trace, rerun the trace and confirm the status is Delivered. Allow 5 to 10 minutes for status to update.
Run Get-MessageTraceV2 for the sender and recipient and confirm Status shows Delivered.
For 5.7.57, confirm Get-CASMailbox shows SmtpClientAuthenticationDisabled as False for the device mailbox, then send a test from the device.
For 5.4.1 or 5.1.10, confirm Get-Recipient returns the address and Get-AcceptedDomain shows the expected DomainType.
For 5.7.23 or 5.7.509, check the headers of a test message to an outside mailbox and confirm SPF, DKIM and DMARC pass.

Confirm delivery after the fix

Get-MessageTraceV2 -SenderAddress [email protected] -RecipientAddress [email protected] -StartDate 10/21/2026 -EndDate 10/22/2026 |
  Format-Table Received,RecipientAddress,Status

When to call a consultant

Send us the NDR and we will tell you where it is failing. A short call is usually enough to scope the fix.

Take the 2-min fit check Talk to a specialist

How Accred Consulting approaches it

Accred starts with the NDR and a message trace, not guesses. Our US-based team reads the status code, traces the message in the Exchange admin center and with Get-MessageTraceV2, and checks the recipients, accepted domains, mail flow rules, connectors and DNS behind it. For recurring bounces we write up the cause and the change, test on a pilot mailbox or device first, then roll it out. Bounce work often uncovers SPF, DKIM or DMARC gaps or a half-finished migration. We scope that work fixed-fee or hourly after a free call.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Sources

Want this scoped for your environment?

Book a free consultation. After discovery you get a written plan with scope, pricing (fixed fee, hourly, retainer or block of hours) and a timeline.

Book a free consultation

How do I fix common Exchange Online bounce (NDR) errors like 550 5.1.10, 5.7.1 and 5.7.57?