NDR stands for Non-Delivery Report — Microsoft's name for the bounce email you receive when Exchange Online cannot deliver your message. NDRs always include a status code like 5.7.26, and often include a component name like STOREDRV or RESOLVER that tells you which part of Exchange rejected the message. That component name is the fastest way to narrow down the cause.

Error 5.4.1 is Microsoft's way of saying your sending IP has a poor reputation in their system. It is the most common blocklist-style rejection from Exchange Online, and it catches a lot of legitimate senders who are on cloud or shared infrastructure. Use the Delist Portal to request removal, and check your IP's standing in SNDS to understand what Microsoft sees about your traffic.

Microsoft is phasing out the old username-and-password method of SMTP authentication (called Basic Auth) in favour of OAuth 2.0, which is what they call Modern Authentication. If you get a 5.7.14 error, it means the email client or app you are using is still trying to log in the old way on an account where Microsoft has turned that off. The fix is to update your client or application to use OAuth 2.0 — older SMTP libraries often need a code change to support this.

A 5.7.13 error means Microsoft's system has flagged the recipient's account as blocked — but it does not always mean the person was intentionally disabled. It can happen after a forced password reset, a suspicious login alert, or even a brief licensing hiccup that temporarily removed the Exchange Online licence. The only person who can fix this is the recipient's IT admin, who needs to re-enable the account in Azure AD or Entra ID.