Email non-delivery reports in Office 365
Applies To: Office for business
When there’s a problem delivering an email message that you sent, Office 365 sends an email to let you know. The email you receive is a delivery status notification, also known as a bounce message. The most common type is called a non-delivery report (NDR) and they tell you that a message wasn’t delivered. Non-delivery can be caused by something as simple as a typo in an email address. NDRs include a code that indicates why your email wasn’t delivered, solutions to help you get your email delivered, a link to more help on the web, and technical details for administrators. Find out
More about what’s included in my NDR email.
Find my NDR code and get help delivering my email
The following table contains the NDR codes (also called enhanced status codes) for the most common bounce messages and NDRs that you might encounter in Office 365.
NDR code |
Description |
Possible cause |
Additional information |
4.4.7 |
Message expired |
The message in the queue has expired. The sending server tried to relay or deliver the message, but the action was not completed before the message expiration time occurred. This message can also indicate that a message header limit has been reached on a remote server, or some other protocol time-out occurred while communicating with the remote server. |
This message usually indicates an issue on the receiving server. Check the validity of the recipient address, and determine if the receiving server is configured correctly to receive messages. You might have to reduce the number of recipients in the message header for the host about which you are receiving this error. If you send the message again, it is placed in the queue again. If the receiving server is available, the message is delivered. For more information, see Fix email delivery issues for error code 4.4.7 in Office 365. |
4.7.26 |
Access denied, a message sent over IPv6 [2a01:111:f200:2004::240] must pass either SPF or DKIM validation, this message is not signed |
The sending message sent over IPv6 must pass either SPF or DKIM. |
For more details, see Support for anonymous inbound email messages over IPv6. |
4.7.500-699 |
Access denied, please try again later |
Suspicious activity has been detected on the IP in question, and it has been temporarily restricted while it is being further evaluated. |
If this activity is valid, this restriction will be lifted shortly. |
4.7.850-899 |
Access denied, please try again later |
Suspicious activity has been detected on the IP in question, and it has been temporarily restricted while it is being further evaluated. |
If this activity is valid, this restriction will be lifted shortly. |
5.1.0 |
Sender denied |
A common cause of this NDR is when you use Microsoft Outlook to save an email message as a file, and then someone opened the message offline and replied to it. The message property only preserves the legacyExchangeDN attribute when Outlook delivers the message, and therefore the lookup could fail. |
Either the recipient address is incorrectly formatted, or the recipient could not be correctly resolved. The first step in resolving this error is to check the recipient address, and send the message again. For more information, see Fix email delivery issues for error code 5.1.0 in Office 365. |
5.1.1 |
Bad destination mailbox address |
This failure might be caused by the following conditions:
|
This error typically occurs when the sender of the message incorrectly enters the email address of the recipient. The sender should check the recipient’s email address and send again. This error can also occur if the recipient email address was correct in the past but has changed or has been removed from the destination email system. If the sender of the message is in the same organization as the recipient, and the recipient’s mailbox still exists, determine whether the recipient’s mailbox has been relocated to a new email server. If this is the case, Outlook might not have updated the recipient cache correctly. Instruct the sender to remove the recipient’s address from sender’s Outlook recipient cache and then create a new message. Resending the original message will result in the same failure. For more information, see Fix email delivery issues for error code 5.1.1 through 5.1.20 in Office 365. |
5.4.1 |
Relay Access Denied |
The mail server that’s generating the error doesn’t accept mail for the recipient’s domain. This error is generally caused by mail server or DNS misconfiguration. |
For more information, see Fix email delivery issues for error code 5.4.1 in Office 365. |
5.4.6 |
Routing loop detected |
A configuration error has caused an email loop. By default, after 20 iterations of an email loop, Exchange interrupts the loop and generates an NDR to the sender of the message. |
This error occurs when the delivery of a message generates another message in response. That message then generates a third message, and the process is repeated, creating a loop. To help protect against exhausting system resources, Exchange interrupts the mail loop after 20 iterations. Mail loops are typically created because of a configuration error on the sending mail server, the receiving mail server, or both. Check the sender’s and the recipient’s mailbox rules configuration to determine whether automatic message forwarding is enabled. For more information, see Fix email delivery issues for error code 5.4.6 through 5.4.20 in Office 365. |
5.6.11 |
Invalid characters |
Your email program added invalid characters (bare line feed characters) into a message you sent. |
For more information, see Fix email delivery issues for error code 5.6.11 in Office 365. |
5.7.1 |
Delivery not authorized |
The sender of the message is not allowed to send messages to the recipient. |
This error occurs when the sender tries to send a message to a recipient but the sender is not authorized to do this. This frequently occurs when a sender tries to send messages to a distribution group that has been configured to accept messages only from members of that distribution group or other authorized senders. The sender must request permission to send messages to the recipient. This error can also occur if an Exchange transport rule rejects a message because the message matched conditions that are configured on the transport rule. For more information, see Fix email delivery issues for error code 5.7.1 in Office 365. |
5.7.1 |
Unable to relay |
The sending email system is not allowed to send a message to an email system where that email system is not the final destination of the message. |
This error occurs when the sending email system tries to send an anonymous message to a receiving email system, and the receiving email system does not accept messages for the domain or domains specified in one or more of the recipients. The following are the most common reasons for this error:
For more information, see Fix email delivery issues for error code 5.7.1 in Office 365. |
5.7.1 |
Client was not authenticated |
The sending email system did not authenticate with the receiving email system. The receiving email system requires authentication before message submission. |
This error occurs when the receiving server must be authenticated before message submission, and the sending email system has not authenticated with the receiving email system. The sending email system administrator must configure the sending email system to authenticate with the receiving email system for delivery to be successful. For more information, see Fix email delivery issues for error code 5.7.1 in Office 365. |
5.7.12 |
Sender was not authenticated by organization |
The sender’s message is rejected because the recipient address is set up to reject messages sent from outside of its organization. Only an email admin for the recipient’s organization can change this. |
For more information, see Fix email delivery issues for error code 5.7.12 in Office 365. |
5.7.124 |
Sender not in allowed-senders list |
The sender doesn’t have permission to send to the distribution group because the sender is not in the group’s allowed-senders list. Depending how the group is set up, even the group’s owner may need to be added to the allowed sender list in order to send messages to the group. |
For more information, see Fix email delivery issues for error code 5.7.124 in Office 365. |
5.7.133 |
Sender not authenticated for group |
The recipient address is a group distribution list that is set up to reject messages sent from outside of its organization. Only an email admin for the recipient’s organization or the group owner can change this. |
For more information, see Fix email delivery issues for error code 5.7.133 in Office 365. |
5.7.134 |
Sender was not authenticated for mailbox |
The recipient address is a mailbox that is set up to reject messages sent from outside of its organization. Only an email admin for the recipient’s organization can change this. |
For more information, see Fix email delivery issues for error code 5.7.134 in Office 365. |
5.7.13 or 135 |
Sender was not authenticated for public folder |
The recipient address is a public folder that is set up to reject messages sent from outside of its organization. Only an email admin for the recipient’s organization can change this. |
For more information, see Fix email delivery issues for error code 5.7.13 or 5.7.135 in Office 365. |
5.7.136 |
Sender was not authenticated |
The recipient address is a mail user that is set up to reject messages sent from outside of its organization. Only an email admin for the recipient’s organization can change this. |
For more information, see Fix email delivery issues for error code 5.7.136 in Office 365. |
5.7.25 |
Access denied, the sending IPv6 address [2a01:111:f200:2004::240] must have a reverse DNS record |
The sending IPv6 address must have a reverse DNS record in order to send email over IPv6. |
For more details, see Support for anonymous inbound email messages over IPv6. |
5.7.501 |
Access denied, spam abuse detected |
The sending account has been banned due to detected spam activity. |
For details, see Fix email delivery issues for error code 451 5.7.500-699 (ASxxx) in Office 365. Verify that any account issues have been resolved, and reset its credentials. To restore this account’s ability to send mail, contact support through your regular channel. |
5.7.502 |
Access denied, banned sender |
The sending account has been banned due to detected spam activity. |
Verify that any account issues have been resolved, and reset its credentials. To restore this account’s ability to send mail, please contact support through your regular channel. |
5.7.503 |
Access denied, banned sender |
The sending account has been banned due to detected spam activity. |
Verify that any account issues have been resolved, and reset its credentials. To restore this account’s ability to send mail, please contact support through your regular channel. |
5.7.504 |
[email@contoso.com]: Recipient address rejected: Access denied |
The recipient address that you are attempting to contact is not valid. |
Verify the recipient’s email address, and try again. |
5.7.505 |
Access denied, banned recipient |
The recipient that you are attempting to contact is not valid. |
If you feel this is in error, contact support. |
5.7.506 |
Access Denied, Bad HELO |
Your server is attempting to introduce itself (HELO according to RFC 821) as the server it is trying to connect to, rather than its own fully qualified domain name. |
This is not allowed, and it is characteristic of typical spambot behavior. |
5.7.507 |
Access denied, rejected by recipient |
The IP that you are attempting to send from has been blocked by the recipient’s organization. |
Contact the recipient in order to resolve this issue. |
5.7.508 |
Access denied, [$SenderIPAddress] has exceeded permitted limits within $range range |
The sender’s IPv6 range has attempted to send too many messages in too short a time period. |
Not applicable |
5.7.509 |
Access denied, sending domain [$SenderDomain] does not pass DMARC verification |
The sender’s domain in the 5322.From address does not pass DMARC. |
Not applicable |
5.7.510 |
Access denied, [contoso.com] does not accept email over IPv6 |
The sender is attempting to transmit a message to the recipient over IPv6, but the recipient does not accept email messages over IPv6. |
Not applicable |
5.7.511 |
Access denied, banned sender |
The account you are attempting to send from has been banned. |
For more information, see Removing a user, domain, or IP address from a block list after sending spam email. |
5.7.512 |
Access denied, message must be RFC 5322 section 3.6.2 compliant |
Message was sent without a valid “From” email address. |
Office 365 only. Each message must contain a valid email address in the “From” header field. Proper formatting of this address includes angle brackets around the email address, for example, <security@contoso.com>. Without this address Office 365 will reject the message. |
5.7.513 |
Service unavailable, Client host [$ConnectingIP] blocked by $recipientDomain using Customer Block list (AS16012607) |
The recipient domain has added your sending IP address to its custom block list. |
The domain that received the email has blocked your sender’s IP address. If you think your IP address has been added to the recipient domain’s custom block list in error, you need to contact them directly and ask them to remove it from the block list. |
5.7.606-649 |
Access denied, banned sending IP [IP1.IP2.IP3.IP4] |
The IP that you are attempting to send from has been banned. |
Verify that you are following the best practices for email deliverability, and ensure your IPs’ reputations have not been degraded as a result of compromise or malicious traffic. If you believe you are receiving this message in error, you can use the self-service portal to request to be removed from this list. For more information, see Use the delist portal to remove yourself from the Office 365 blocked senders list. |
5.7.700-749 |
Access denied, tenant has exceeded threshold |
The majority of traffic from this tenant has been detected as suspicious and has resulted in a ban on sending ability for the tenant. |
Ensure that any compromises or open relays have been resolved, and then contact support through your regular channel. |
I don’t see the purpose of this article at all, it basically a direct copy of the linked Microsoft article.
LikeLike
because this is something must be know like the times table every number has a meaning
LikeLike