Published · Last verified · Maintained by TamingDNS
🪟 Microsoft 365 / Outlook SMTP Error Code Directory
Microsoft 365 bounce emails are packed with internal component names like RESOLVER and STOREDRV alongside standard SMTP codes, which makes them look far more intimidating than they are. This directory translates every Exchange Online rejection into plain English, with a fix for each one.
How to Identify a Microsoft 365 Bounce
Microsoft 365 NDRs arrive from [email protected] or postmaster@<tenant>.onmicrosoft.com. The Diagnostic-Code often includes a proprietary component name like RESOLVER (routing/addressing) or STOREDRV (mailbox store delivery).
Diagnostic-Code: smtp; 550 5.7.13 STOREDRV.Deliver.Exception:AccountDisabledException.MapiExceptionADUserDisabledAndHidden; Failed to process message due to a permanent exception with message [BeginDiagnosticData]...
The component prefix (STOREDRV, RESOLVER, QUEUE) tells you which part of Exchange Online rejected the message. See the glossary below.
Microsoft 365 Error Codes
15 codes with Microsoft 365-specific behaviour. Critical (Tier 1) codes appear first.
Microsoft NDR Component Glossary
The component prefix in an Exchange Online NDR tells you which subsystem rejected or failed to deliver the message.
Microsoft Sender Tools
Microsoft provides two free tools for senders who are being blocked by Exchange Online:
Frequently Asked Questions
Common questions about Microsoft 365 SMTP errors and Exchange Online NDRs.
What is an NDR in Microsoft 365?
NDR stands for Non-Delivery Report, Microsoft's name for the bounce email you receive when Exchange Online cannot deliver your message. NDRs always include a status code like 5.7.23, and often include a component name like STOREDRV or RESOLVER that tells you which part of Exchange rejected the message. That component name is the fastest way to narrow down the cause.
Why does Microsoft 365 return 5.4.1 for legitimate senders?
Because 5.4.1 covers two different situations and its wording does not tell you which. Microsoft documents it as directory-based edge blocking rejecting an invalid recipient, and every fix it lists is recipient-side. Senders also report it with SPF, DKIM and DMARC all passing, on freshly rented IPs, where only delisting helps. Microsoft publishes nothing confirming a reputation path for this code. One test separates them: send to a second address you know is valid at the same organisation. If every recipient there bounces, work your IP's standing in SNDS and the Delist Portal. If only one bounces, the address is the problem.
What is Modern Authentication and why is it causing 5.7.14 errors?
Microsoft is phasing out the old username-and-password method of SMTP authentication (called Basic Auth) in favour of OAuth 2.0, which is what they call Modern Authentication. If you get a 5.7.14 error, it means the email client or app you are using is still trying to log in the old way on an account where Microsoft has turned that off. The fix is to update your client or application to use OAuth 2.0. Older SMTP libraries often need a code change to support this.
Why does a 5.7.13 error say "account disabled" when the person still works here?
A 5.7.13 error means Microsoft's system has flagged the recipient's account as blocked, but it does not always mean the person was intentionally disabled. It can happen after a forced password reset, a suspicious login alert, or even a brief licensing hiccup that temporarily removed the Exchange Online licence. The only person who can fix this is the recipient's IT admin, who needs to re-enable the account in Azure AD or Entra ID.
Other Provider Directories
Got a Microsoft 365 bounce to decode?
Paste your full NDR email or SMTP error line for an instant plain-English diagnosis.
Open the Bounce Decoder →