Email non-delivery reports in Exchange Online

  • Commodity
  • 27 minutes to read

When in that location'southward a problem delivering an email message that yous sent, Microsoft 365 or Office 365 sends an email to let you know. The e-mail you lot receive is a delivery status notification, also known as a DSN or bounce message. The most common blazon is called a non-delivery written report (NDR) and they tell you lot that a message wasn't delivered. Non-delivery tin can be caused by something as simple as a typo in an email address. NDRs include an error code that indicates why your email wasn't delivered, solutions to help you go your electronic mail delivered, a link to more than aid on the web, and technical details for administrators. Find out What'south included in an NDR?.

Discover my NDR lawmaking and get aid delivering my electronic mail

The following table contains the NDR codes (also called enhanced status codes) for the most mutual bounce messages and NDRs that y'all might encounter in Exchange Online.

NDR code Description Possible cause Additional information
432 four.three.ii STOREDRV.Deliver; recipient thread limit exceeded The recipient mailbox'south ability to take letters is being throttled because it's receiving besides many messages as well quickly. This is done so a unmarried recipient'south mail processing doesn't unfairly affect other recipients sharing the aforementioned mailbox database. For more information most this by-pattern throttling, see Store Driver Fault Isolation Improvements in Exchange 2010 SP1.
4.4.316 Connection refused [Message=Socket error code 10061] Microsoft 365 or Office 365 is trying to ship a bulletin to an email server outside of Microsoft 365 or Function 365, only attempts to connect to it are declining due to a network connectedness issue at the external server'due south location. This error most always indicates an issue with the receiving server or network outside of Microsoft 365 or Role 365. The error should too include the IP address of the server or service that's generating the mistake, which you can utilise to identify the party responsible for fixing this.
4.4.7 Message expired The message in the queue has expired. The sending server tried to relay or evangelize the message, but the action wasn't completed earlier the message expiration fourth dimension occurred. This message can too indicate that a bulletin header limit has been reached on a remote server, or some other protocol fourth dimension-out occurred while communicating with the remote server. This bulletin usually indicates an result on the receiving server. Check the validity of the recipient address, and decide if the receiving server is configured correctly to receive messages.

You might have to reduce the number of recipients in the message header for the host about which you're receiving this error. If you lot send the message again, it's placed in the queue again. If the receiving server is bachelor, the message is delivered.

For more data, see Ready email delivery bug for error code 4.four.7 in Exchange Online.
4.5.3 Too many recipients The message has more than 200 SMTP envelope recipients from the same domain. An envelope recipient is the original, unexpanded recipient that's used in the RCPT TO command to transmit the message betwixt SMTP servers. When this error is returned by Microsoft 365 or Office 365, the sending server must break up the number of envelope recipients into smaller chunks (chunking) and resend the message.
4.seven.26 Admission denied, a bulletin sent over IPv6 [2a01:111:f200:2004::240] must pass either SPF or DKIM validation, this message is non signed The sending message sent over IPv6 must pass either SPF or DKIM. For more than information, see Support for anonymous inbound email letters over IPv6.
4.7.321 starttls-not-supported: Destination mail service server must back up TLS to receive mail. DNSSEC checks have passed, all the same upon connection, destination mail server doesn't reply to the STARTTLS command.
  • The destination server responds to the STARTTLS command, but the TLS handshake fails.
    		•  This message normally indicates an issue on the destination electronic mail server. Check the validity of the recipient address. Decide if the destination server is configured correctly to receive the letters.
    4.7.322 certificate-expired: Destination mail service server's certificate is expired. DNSSEC checks accept passed, yet upon establishing the connection, the destination mail service server provides a certificate that is expired. A valid Ten.509 certificate that isn't expired must be presented. X.509 certificates must be renewed after their expiration, commonly annually.
    4.7.323 tlsa-invalid: The domain failed DANE validation. Records are DNSSEC accurate, simply one or multiple of these scenarios occurred:
    • The destination postal service server'south certificate doesn't match with what is expected per the authentic TLSA record.
    • Authentic TLSA tape is misconfigured.
    • Destination domain is being attacked.
    • Any other DANE failure.
    		 This message usually indicates an issue on the destination electronic mail server. Check the validity of recipient address and determine if the destination server is configured correctly to receive messages. For more information, run across DANE protocol: updates and operational guidance
    4.seven.324 dnssec-invalid: Destination domain returned invalid DNSSEC records The destination domain indicated it was DNSSEC-authentic, but Exchange Online wasn't able to verify information technology every bit DNSSEC-authentic. For more information, encounter Overview of DNSSEC.
    4.7.325 certificate-host-mismatch: Remote certificate MUST accept a common name or subject alternative proper noun matching the hostname (DANE) This happens when the presented certificate identities (CN and SAN) of a destination SMTP target host don't match whatsoever of the domains or MX host. This message usually indicates an upshot on the destination email server. Check the validity of recipient address and determine if the destination server is configured correctly to receive messages. For more information, come across How SMTP DNS-based Authentication of Named Entities (DANE) works to secure email communications.
    four.7.500-699 Admission denied, delight try again afterwards Suspicious activeness has been detected and sending has been temporarily restricted for further evaluation. If this activity is valid, this restriction will be lifted presently.
    4.7.850-899 Access denied, please try again later Suspicious activity has been detected on the IP in question, and it has been temporarily restricted while it's being farther evaluated. If this activeness is valid, this restriction will be lifted presently.
    5.0.350 Generic error, x-dg-ref header is too long, or Requested action not taken: policy violation detected (AS345) v.0.350 is a generic catch-all error code for a broad variety of non-specific errors from the recipient'southward email organisation. The specific x-dg-ref header is besides long message is related to Rich Text formatted messages. The specific Requested action not taken: policy violation detected (AS345) message is related to nested attachments. For more information, see Set up email delivery issues for mistake code 550 5.0.350 in Exchange Online.
    five.1.0 Sender denied A common cause of this NDR is when y'all utilise Microsoft Outlook to salvage an e-mail message every bit a file, and and so someone opened the bulletin offline and replied to it. The message property just preserves the legacyExchangeDN attribute when Outlook delivers the bulletin, and therefore the lookup could fail. Either the recipient address is incorrectly formatted, or the recipient couldn't be correctly resolved. The kickoff step in resolving this error is to bank check the recipient address, and transport the bulletin again.

    For more than information, see Fix e-mail commitment issues for error lawmaking 5.1.0 in Exchange Online.
    5.1.one Bad destination mailbox address This failure might be caused by the following conditions:
    • The recipient's e-mail address was entered incorrectly past the sender.
    • No recipient's exists in the destination electronic mail system.
      • The recipient's mailbox has been moved and the Outlook recipient cache on the sender's estimator hasn't updated.
    • An invalid legacy domain proper name (DN) exists for the recipient's mailbox Active Directory Domain Service.
    		 This error typically occurs when the sender of the message incorrectly enters the electronic mail address of the recipient. The sender should bank check the recipient's email accost and send once again. This mistake can also occur if the recipient electronic mail address was correct in the past but has inverse or has been removed from the destination email system.

    If the sender of the message is in the same organization as the recipient, and the recipient's mailbox still exists, determine whether the recipient'due south mailbox has been relocated to a new email server. If this is the example, Outlook might not have updated the recipient cache correctly. Instruct the sender to remove the recipient's address from sender'southward Outlook recipient enshroud and then create a new message. Resending the original bulletin volition result in the same failure.

    For more data, meet Fix e-mail commitment issues for error code 5.one.ane through 5.1.20 in Substitution Online.
    5.1.8 Admission denied, bad outbound sender The account has been blocked for sending likewise much spam. Typically, this problem occurs because the account has been compromised (hacked) by phishing or malware. For more than information, come across Fix email delivery issues for error code v.1.viii in Exchange Online.
    5.1.10 Recipient not institute The recipient's <SMTP Accost> wasn't institute by SMTP address lookup. For more information, see Fix email delivery problems for error code 550 5.1.ten in Exchange Online.
    5.1.90 Your message can't exist sent because y'all've reached your daily limit for message recipients The sender has exceeded the recipient rate limit as described in Sending limits. This could indicate the account has been compromised and is being used to send spam. For more information, see How to determine whether your account has been compromised.
    5.2.two Submission quota exceeded The sender has exceeded the recipient rate limit or the bulletin rate limit as described in Sending limits. This could indicate the account has been compromised and is being used to send spam. For more than information, see How to determine whether your account has been compromised.
    five.two.121 Recipient'due south per 60 minutes message receive limit from specific sender exceeded. The sender has exceeded the maximum number of letters they're allowed to send per hour to a specific recipient in Exchange Online. The automated mailer or sender should endeavor again later, and reduce the number of messages they ship per 60 minutes to a specific recipient.

    This limit helps protect Microsoft 365 or Office 365 users from rapidly filling their inboxes with a large number of letters from errant automated notification systems or other single-sender postal service storms.
    5.2.122 Recipient'southward per hour message receive limit exceeded. The Microsoft 365 or Office 365 recipient has exceeded the number of messages they can receive per hour from all senders. The automated mailer or sender should endeavour again afterwards, and reduce the number of letters they send per hr to a specific recipient.

    This limit helps protect Microsoft 365 and Office 365 users from speedily filling their inboxes with a big number of messages from errant automated notification systems or other postal service storms.
    five.3.190 Journaling on-bounds messages to Microsoft 365 or Office 365 not supported when Journaling Annal is disabled. Journaling on-premises messages to Microsoft 365 or Office 365 isn't supported for this organization because they haven't turned on Journaling Archive in their settings. A journaling rule is configured in the arrangement's on-premises environs to periodical on-bounds messages to Microsoft 365 or Office 365, but Journaling Archive is disabled. For this scenario to work, the organization's Part 365 administrator should either enable Journaling Annal or alter the journaling rule to journal messages to a dissimilar location.
    five.4.1 Relay Access Denied The mail server that's generating the mistake doesn't take post for the recipient'south domain. This error is caused past mail server or DNS misconfiguration. For more information, run into Prepare email delivery issues for error lawmaking 5.4.1 in Exchange Online.
    five.iv.1 Recipient address rejected: Access denied The recipient's accost doesn't exist. For more information, see Utilize Directory Based Edge Blocking to refuse messages sent to invalid recipients.
    5.4.6 or 5.iv.14 Routing loop detected A configuration error has caused an email loop. five.4.6 is generated by on-premises Exchange server (you'll come across this lawmaking in hybrid environments). v.4.14 is generated by Exchange Online.

    By default, after xx iterations of an email loop, Exchange interrupts the loop and generates an NDR to the sender of the message.

    		 This error occurs when the commitment of a bulletin generates another message in response. That message then generates a third message, and the procedure is repeated, creating a loop. To help protect confronting exhausting system resources, Exchange interrupts the mail loop after xx iterations. Mail loops are typically created because of a configuration fault on the sending mail server, the receiving mail server, or both. Bank check the sender's and the recipient's mailbox rules configuration to determine whether automatic bulletin forwarding is enabled.

    For more information, meet Fix email delivery issues for error code five.4.6 or five.iv.fourteen in Exchange Online.
    v.iv.300 Message expired The electronic mail took too long to be successfully delivered, either because the destination server never responded or the sent message generated an NDR fault and that NDR couldn't be delivered to the original sender.
    v.5.0 550 five.five.0 Requested action non taken: mailbox unavailable The recipient'south <SMTP Address> domain is @hotmail.com or @outlook.com and information technology wasn't institute past SMTP address lookup. Similar to 550 5.one.10. For more than information, see Fix e-mail delivery issues for error code 550 5.1.ten in Exchange Online.
    5.6.11 Invalid characters Your email plan added invalid characters (bare line feed characters) into a message yous sent. For more data, see Fix email delivery problems for error code 5.6.11 in Commutation Online.
    5.vii.i Delivery not authorized The sender of the message isn't immune to ship messages to the recipient. This fault occurs when the sender tries to send a message to a recipient simply the sender isn't authorized to do this. This oftentimes occurs when a sender tries to send messages to a distribution group that has been configured to accept messages only from members of that distribution group or other authorized senders. The sender must request permission to ship letters to the recipient.

    This mistake can also occur if an Exchange transport dominion rejects a message because the message matched conditions that are configured on the ship dominion.

    For more than information, run into Fix email delivery bug for mistake code 5.7.1 in Exchange Online.
    5.7.1 Unable to relay The sending email organisation isn't allowed to send a message to an email system where that e-mail organisation isn't the concluding destination of the message. This error occurs when the sending email arrangement tries to send an bearding bulletin to a receiving email system, and the receiving email organization doesn't accept messages for the domain or domains specified in one or more than of the recipients. The following are the most common reasons for this fault:
    • A third party tries to apply a receiving electronic mail system to send spam, and the receiving email organization rejects the attempt. By the nature of spam, the sender's email address might have been forged, and the resulting NDR could have been sent to the unsuspecting sender's email address. It's difficult to avoid this state of affairs.
    • An MX record for a domain points to a receiving e-mail system where that domain isn't accepted. The administrator responsible for the specific domain name must correct the MX tape or configure the receiving email arrangement to accept letters sent to that domain, or both.
    • A sending email system or client that should use the receiving electronic mail organization to relay messages doesn't have the correct permissions to do this.

    For more data, run into Fix e-mail delivery problems for mistake code 5.7.1 in Exchange Online.
    5.7.1 Customer was non authenticated The sending e-mail organization didn't authenticate with the receiving electronic mail organisation. The receiving email system requires authentication before message submission. This fault occurs when the receiving server must be authenticated before bulletin submission, and the sending email organization hasn't authenticated with the receiving email system. The sending electronic mail system administrator must configure the sending email organisation to authenticate with the receiving email system for delivery to be successful.

    For more than information, see Fix email commitment problems for mistake lawmaking 5.7.i in Commutation Online.
    v.7.12 Sender was not authenticated by organization The sender'due south message is rejected considering the recipient address is gear up up to reject letters sent from outside of its arrangement. Merely an electronic mail admin for the recipient'due south organization tin change this. For more information, run into Fix email delivery issues for error code five.7.12 in Commutation Online.
    5.vii.23 The message was rejected because of Sender Policy Framework violation The destination e-mail arrangement uses SPF to validate entering mail, and there'south a trouble with your SPF configuration. For more information, see Ready email delivery issues for error code 5.vii.23 in Exchange Online.
    5.7.57 Client was not authenticated to send anonymous mail during MAIL FROM You lot configured an application or device to transport (relay) email letters in Microsoft 365 or Function 365 using the smtp.office365.com endpoint, and there's a trouble with the configuration of the application or device. For more than information, run across Set electronic mail commitment bug for error lawmaking 5.vii.57 in Exchange Online.
    5.vii.64 TenantAttribution; Relay Access Denied Yous apply an entering connector to receive letters from your on-bounds email environment, and something has changed in your on-premises environment that makes the inbound connector'south configuration incorrect. For more information, run into Fix email commitment issues for mistake code five.7.64 in Exchange Online.
    five.7.124 Sender not in allowed-senders listing The sender doesn't accept permission to transport to the distribution group because the sender isn't in the grouping's allowed-senders list. Depending how the group is gear up, even the group'due south owner might demand to exist added to the allowed sender list in order to send letters to the group. For more information, see Fix e-mail delivery issues for error code five.7.124 in Commutation Online.
    v.7.133 Sender non authenticated for group The recipient address is a group distribution list that is set to refuse letters sent from outside of its organization. Only an email admin for the recipient's arrangement or the group possessor can alter this. For more information, see Fix electronic mail delivery issues for error code 5.7.133 in Commutation Online.
    five.vii.134 Sender was not authenticated for mailbox The recipient accost is a mailbox that is gear up to reject letters sent from outside of its system. Only an email admin for the recipient's organisation tin can alter this. For more information, meet Set electronic mail delivery issues for error lawmaking v.7.134 in Exchange Online.
    five.7.13 or 135 Sender was not authenticated for public folder The recipient accost is a public binder that is fix to reject messages sent from outside of its system. Only an electronic mail admin for the recipient'due south arrangement can change this. For more data, see Set email commitment problems for mistake code 5.7.xiii or 5.7.135 in Commutation Online.
    five.7.136 Sender was non authenticated The recipient address is a mail service user that is set up to reject messages sent from outside of its organization. Only an email admin for the recipient's organization can change this. For more information, see Set e-mail delivery bug for error lawmaking 5.vii.136 in Exchange Online.
    five.vii.25 Access denied, the sending IPv6 accost [2a01:111:f200:2004::240] must have a reverse DNS record The sending IPv6 accost must have a reverse DNS record in order to transport email over IPv6. For more than information, see Support for anonymous inbound email messages over IPv6.
    5.vii.321 starttls-not-supported: Destination mail server must support TLS to receive mail.
    • DNSSEC checks have passed, yet upon connection the destination post server doesn't respond to the STARTTLS command.
    • The destination server responds to the STARTTLS command, but the TLS handshake fails.
    		This message ordinarily indicates an issue on the destination mail server. Bank check the validity of the recipient accost and determine if the destination server is configured correctly to receive messages.
    5.7.322 certificate-expired: Destination mail server's certificate is expired. DNSSEC checks accept passed, nonetheless upon establishing the connection the destination mail server provides a certificate that is expired. A valid 10.509 certificate that isn't expired must be presented. 10.509 certificates must be renewed after their expiration, commonly annually.
    5.7.323 tlsa-invalid: The domain failed DANE validation. Records are DNSSEC accurate but one or multiple of these things occurred:
    • The destination mail server'due south certificate doesn't match with what is expected per the authentic TLSA record.
    • Authentic TLSA record is misconfigured.
    • Destination domain is existence attacked.
    • The document showtime date is in the future.
    • Whatever other DANE failure.
    		 This message usually indicates an issue on the destination mail server. Bank check the validity of the recipient address and determine if the destination server is configured correctly to receive messages.

    For more information about DANE, run into: https://datatracker.ietf.org/physician/html/rfc7671.|
    5.7.324 dnssec-invalid: Destination domain returned invalid DNSSEC records The destination domain indicated information technology was DNSSEC-authentic but Exchange Online wasn't able to verify it every bit DNSSEC-authentic. For more data nearly DNSSEC, see: Overview of DNSSEC.
    five.7.325 certificate-host-mismatch: Remote document MUST accept a common name or subject alternative proper name matching the hostname (DANE) This happens when the presented certificate identities (CN and SAN) of a destination SMTP target host don't lucifer any of the domains or MX host. This message usually indicates an issue on the destination email server. Cheque the validity of recipient address and determine if the destination server is configured correctly to receive messages. For more information, meet How SMTP DNS-based Authentication of Named Entities (DANE) works to secure e-mail communications.
    5.7.501 Access denied, spam abuse detected The sending business relationship has been banned due to detected spam activity. For details, see Set e-mail delivery problems for error code 451 5.7.500-699 (ASxxx) in Exchange Online.

    Verify that any account issues have been resolved, and reset its credentials. To restore this business relationship's ability to transport mail, contact support through your regular channel.
    5.seven.502 Access denied, banned sender The sending business relationship has been banned due to detected spam activity. Verify that any business relationship issues have been resolved, and reset its credentials. To restore this business relationship'south ability to transport postal service, please contact support through your regular channel.
    five.7.503 Access denied, banned sender The sending account has been banned due to detected spam activity. Verify that any account issues take been resolved, and reset its credentials. To restore this business relationship's ability to send mail, delight contact support through your regular channel.
    5.7.504 [email@contoso.com]: Recipient accost rejected: Access denied The recipient address that y'all're attempting to contact isn't valid. Verify the recipient's e-mail address, and try again.
    5.vii.505 Admission denied, banned recipient The recipient that you're attempting to contact isn't valid. If you experience this is in error, contact back up.
    5.7.506 Admission Denied, Bad HELO Your server is attempting to innovate itself (HELO according to RFC 821) as the server it's trying to connect to, rather than its own fully qualified domain proper name. This isn't allowed, and it's characteristic of typical spambot beliefs.
    5.7.507 Admission denied, rejected past recipient The IP that you're attempting to send from has been blocked by the recipient's organisation. Contact the recipient in order to resolve this effect.
    5.seven.508 Access denied, [$SenderIPAddress] has exceeded permitted limits within $range range The sender'southward IPv6 range has attempted to send also many letters in too short a time flow. Not applicable
    v.vii.509 Access denied, sending domain [$SenderDomain] does not pass DMARC verification The sender's domain in the 5322.From accost doesn't pass DMARC. Not applicative
    v.7.510 Admission denied, [contoso.com] does non take e-mail over IPv6 The sender is attempting to transmit a bulletin to the recipient over IPv6, merely the recipient doesn't have e-mail letters over IPv6. Not applicative
    v.7.511 Access denied, banned sender The IP that you're attempting to ship from has been banned. To delist the address, e-mail delist@messaging.microsoft.com and provide the total NDR code and IP address to delist.

    For more than information, run across Use the delist portal to remove yourself from the blocked senders listing.
    5.7.512 Admission denied, message must be RFC 5322 section 3.6.2 compliant Bulletin was sent without a valid "From" electronic mail address. Office 365 only. Each message must incorporate a valid email address in the "From" header field. Proper formatting of this accost includes bending brackets effectually the electronic mail address, for example, <security@contoso.com>. Without this address Microsoft 365 or Office 365 will turn down the message.
    five.7.513 Service unavailable, Client host [$ConnectingIP] blocked by $recipientDomain using Customer Block list (AS16012607) The recipient domain has added your sending IP address to its custom blocklist. The domain that received the email has blocked your sender'southward IP address. If you think your IP accost has been added to the recipient domain's custom blocklist in fault, you need to contact them direct and enquire them to remove it from the blocklist.
    5.7.606-649 Access denied, banned sending IP [IP1.IP2.IP3.IP4] The IP that you're attempting to send from has been banned. Verify that you lot're post-obit the best practices for email deliverability, and ensure your IPs' reputations haven't been degraded as a result of compromise or malicious traffic. If you believe y'all're receiving this message in error, you tin use the cocky-service portal to request to be removed from this listing.

    For more information, see Use the delist portal to remove yourself from the blocked senders list.
    5.7.700-749 5.vii.705 Admission denied, tenant has exceeded threshold, v.7.708 Access denied, traffic non accepted from this IP The majority of traffic from this tenant has been detected as suspicious and has resulted in a ban on sending power for the tenant. Ensure that any compromises or open relays have been resolved, and then contact back up through your regular channel.

    For more than data, run into Set up email commitment bug for error codes 5.vii.700 through v.7.750 in Commutation Online.
    5.7.750 Service unavailable. Customer blocked from sending from unregistered domains A suspicious number of messages from unprovisioned domains is coming from this tenant. Add and validate any and all domains that you use to send email from Microsoft 365 or Office 365.

    For more information, encounter Set up email delivery bug for error codes 5.seven.700 through 5.7.750 in Exchange Online.
    due north/a The bulletin can't exist submitted because the sender'due south submission quota was exceeded The user business relationship has exceeded the recipient rate limit (10,000 recipients per day). The business relationship has likely been compromised. For more information, see Set up electronic mail delivery problems for error 'the sender's submission quota was exceeded' in Exchange Online.

    Run not-delivery written report diagnostics

    Note

    This feature requires a Microsoft 365 administrator business relationship. This feature isn't bachelor for Microsoft 365 Authorities, Microsoft 365 operated past 21Vianet, or Microsoft 365 Germany.

    To acquire more than nearly the description of the non-commitment report (NDR), possible cause, and solution by running the following NDR diagnostic, you can run an automated diagnostic. Brand certain you get the NDR code or status code from the undeliverable/non-delivery written report.

    To run the diagnostic bank check, select the following button:

    A flyout page opens in the Microsoft 365 admin center. Paste the NDR code or error message, then select Run Tests.

    What'south included in an NDR?

    Exchange NDRs are designed to be piece of cake to read and understand by e-mail users and administrators. At that place are a couple of different formats for NDRs. The newest style NDR contains a trouble description in everyday language, forth with steps to ready information technology. The post-obit figure shows the format for this type of NDR.

    Newest format for delivery status notification (DSN) in Exchange Online.

    Information provided in the newest way NDRs is designed to aid the typical email user solve their problem immediately. When that isn't possible, the NDR provides details for administrators and also a link to more help on the web. The following fields appear in the newest Function 365 NDRs.

    Field Description
    Office 365 logo This indicates that Microsoft 365 or Office 365 generated the NDR. The logo doesn't mean that Microsoft 365 or Office 365 was responsible for the error. This tells which messaging endpoints or services are involved in the e-mail transaction, which isn't always clear in older manner NDRs.
    Crusade This section provides the reason that the message wasn't delivered.
    Fix-it possessor indicator This section provides an at-a-glance view of the issue and who needs to prepare it. The image shows the 3 bones parties in a Microsoft 365 or Office 365 email transaction: the sender, Microsoft 365 or Office 365, and the recipient. The area marked in red is where the problem usually must be stock-still.
    How to set up it This section is designed for the cease-user or the electronic mail sender who receives the NDR. It explains how to fix the issue.
    More than info for electronic mail admins This section provides a detailed explanation of the problem and solution forth with technical details and a link to a web-based article that has detailed reference information.
    Message hops This section contains times and organisation references for the message, which allows an admin to follow the message'southward hops or server-to-server path. With this info, an admin might rapidly spot problems betwixt bulletin hops.

    For NDRs that don't have the latest format, the information might be separated into two sections: User data, and Diagnostic data for administrators. The following figure shows the format for one type of Commutation Online NDR.

    NDR showing User and Administrator Diagnostic Info.

    User information

    The user information department appears first in some NDRs, and the primary purpose is to provide a summary about what went wrong. The text is designed to assistance the message sender determine why the bulletin was rejected and, if possible, how to resend the message successfully. The email address of each recipient is listed, and the reason for the failure is included in the infinite below the recipient's email address. The name of the mail server that rejected the message might also be included in this department.

    Diagnostic information for administrators

    The Diagnostic data for administrators section provides deeper technical information to aid administrators troubleshoot the message delivery problem. It contains detailed information about the specific error that occurred during commitment of the message, the server that generated the NDR, and the server that rejected the message. This department uses the post-obit format:

                  Diagnostic information for administrators Generating server: <server name>           <rejected recipient>           <remote server>            <enhanced status lawmaking>  <SMTP response> Original bulletin headers <bulletin header fields>
    Field Clarification
    Generating server This field indicates the proper noun of the SMTP postal service server that created the NDR. If no remote server is listed below the sender's email address, the generating server is also the server that rejected the original email bulletin. When the remote mail server acknowledges and accepts the message, but later rejects the message, for instance, because of content restrictions, the remote server generates the NDR. If the remote mail server never acknowledges and never accepts the message, the sending server in Substitution Online generates the NDR.
    <Rejected recipient> This value is the email address of the recipient. If delivery failed to more than one recipient, the email address for each recipient is listed. The following data is also included for each failed recipient:
    • Field
    • Clarification
    <Remote server> This value is the name of the mail server that rejected the message. If the original bulletin is successfully best-selling by the receiving server, just is later rejected, the remote server value isn't populated.
    <Enhanced status lawmaking> This value is assigned by the mail server that rejected the original message and indicates why the message was rejected. These codes are defined in RFC 3463, and use the format abc x.y.z, where the placeholder values are integers. For example, a 5.x.x lawmaking indicates a permanent error, and a iv.x.x code indicates a temporary mistake. Although the enhanced status code is often generated by an external mail server, Exchange Online uses the enhanced status code value to decide the text to brandish in the user information section.
    <SMTP response> This value is returned by the postal service server that rejected the original message. This text provides an caption for the enhanced status code value. The text is always presented in The states-ASCII format.
    Original message headers This section contains the bulletin header fields of the rejected message. These header fields can provide useful diagnostic information, such as the path that the message took before it was rejected, or whether the To field value matches the rejected recipient value.

    How to interpret an Exchange NDR

    Here's an example. Suppose you receive an Exchange NDR that contains the following information:

                  Delivery has failed to these recipients or groups: ronald@contoso.com Your message wasn't delivered due to a permission or security upshot. It might have been rejected by a moderator, the accost might only accept email from certain senders, or another restriction might be preventing commitment. The following arrangement rejected your bulletin: mail.contoso.com. Diagnostic data for administrators: Generating server: alpineskihouse.com ronald@contoso.com mail.contoso.com #<substitution.contoso.com #5.7.one smtp;530 5.7.1 Client was not authenticated> #SMTP# Original message headers: ...

    From the user information section, y'all can determine that the recipient is Ronald Slattery, and that the bulletin was rejected by the postal service server mail.contoso.com, which isn't an Exchange Online or Commutation Online Protection postal service server.

    From the Diagnostic data for administrators section, you can see that alpineskihouse.com attempted to connect to the server mail service.contoso.com to deliver the bulletin to the recipient ronald@contoso.com. Still, postal service.contoso.com responded with the error 530 5.vii.1 Customer was not authenticated. Even though bigfish.com generated the NDR, mail.contoso.com actually rejected the message, so the administrators at contoso.com are responsible for understanding and fixing the problem. This detail error indicates that the server mail.contoso.com is configured not to accept anonymous email from the Internet.

    Although the Original message headers are omitted from this example due to their length and complexity, you can typically extract useful data from the following header fields:

    • To: This field might be helpful if the electronic mail accost was mistyped.

    • Received: These fields tin tell you what the path was for the message, and the last hop that generated the delivery status notification if information technology isn't easy to tell from the Generating server value in the NDR.

    • Received-SPF: If this value is anything other than pass, cheque the Sender Policy Framework (SPF) DNS tape for your domain. For more information, see Add together or edit custom DNS records.

    Even so demand aid with NDRs or other status notifications?

    Get help from the community forums.

    Admins: Sign in and create a service request.

    Admins: Call Support.