🪟 Microsoft 365 / Outlook SMTP Error Code Directory

NDR stands for Non-Delivery Report, Microsoft's name for the bounce email you receive when Exchange Online cannot deliver your message. NDRs always include a status code like 5.7.23, and often include a component name like STOREDRV or RESOLVER that tells you which part of Exchange rejected the message. That component name is the fastest way to narrow down the cause.

Microsoft lists two meanings for 5.4.1, and the text beside the code tells them apart. Its NDR list gives "Relay Access Denied" to a server that does not accept mail for the recipient's domain. "Recipient address rejected: Access denied" is directory-based edge blocking rejecting an invalid recipient, and every fix Microsoft lists is recipient-side. Senders also report that one with SPF, DKIM and DMARC all passing. Microsoft publishes nothing confirming a reputation path for this code. Send to a second address you know is valid at the same organisation. If only one bounces, the address is the problem. If every recipient there bounces, Microsoft's fix is still on their side: its troubleshooting page has their admin resync the accepted domain. Only if that changes nothing, and SPF, DKIM and DMARC all pass, check your sending IP with our Blacklist Checker and the Microsoft delist portal.

Microsoft is phasing out the old username-and-password method of SMTP authentication (called Basic Auth) in favour of OAuth 2.0, which is what they call Modern Authentication. If you get a 5.7.14 error, it means the email client or app you are using is still trying to log in the old way on an account where Microsoft has turned that off. The fix is to update your client or application to use OAuth 2.0. Older SMTP libraries often need a code change to support this.

Read the text beside the code. Microsoft documents 5.7.13 for a public folder that rejects mail from outside the organisation, and only an email admin in the recipient's organisation can change that. The IANA registry names the code "User Account Disabled": an account disabled after a successful sign-in, which points at your own sending account. Senders also report bounces naming STOREDRV and an AccountDisabledException with this code. Microsoft does not document that form, so ask the recipient's IT team rather than guess.