What the receiver is telling you

Despite the 5.4 routing class and the words 'access denied', this is Microsoft's user-unknown. Tenants with Directory-Based Edge Blocking turned on reject any recipient not in the tenant directory at the network edge, before the message is accepted, and this is the code that produces. It looks like a policy block and gets escalated as one; it is a bad address. The AS(…) number identifies the anti-spam rule that fired, and for this code it is always the DBEB rule.

What a hard bounce means for your reputation

Receivers count hard bounces. Gmail and Microsoft both treat a sender whose mail is addressed to people who do not exist as a sender who did not get those addresses from the people themselves, which is the definition of unsolicited. The working threshold is two percent of a send: under that is noise, above it starts to cost domain reputation, and above five percent a fresh domain can be throttled after a single campaign. The fix is upstream — verify before sending — not downstream.

What to do

1. Remove the address. The person is not in that company's directory.
2. If you are certain they are — you spoke to them yesterday — the tenant may be syncing a new user; try once after 24 hours.
3. If a whole domain returns 5.4.1, the company enabled DBEB with an incomplete directory. Their problem, not yours.

don't Do not treat it as a reputation block and pause the domain. Nothing about your sending caused it.

Decode the whole bounce

Paste the complete failure notice — every code and the receiver's wording — and get each part explained together.

Common questions