'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Exchange Hybrid 550 NDR: Online to On-Premises Email Fails
Question details
Users in an Exchange hybrid environment receive a 550 NDR when attempting to send emails from Exchange Online to on-premises mailboxes.
- Product
- Microsoft Exchange Online
- Device & OS
- not provided
- Scenario
- Routing emails from cloud-hosted Exchange Online mailboxes to on-premises Exchange servers in a hybrid deployment.
- Observed behavior
- Emails fail to deliver and return a 550 5.4.1 Non-Delivery Report (NDR) stating recipient address rejected or access denied.
Ensure you have Exchange administrator privileges in Microsoft 365 and access to your on-premises Microsoft Entra Connect synchronization server.
Configure Accepted Domain as Internal Relay and Synchronize Accounts
Adjusting the accepted domain type to Internal Relay prevents Exchange Online from improperly rejecting unrecognized recipients through Directory-Based Edge Blocking (DBEB).
When a shared domain is set to Authoritative, DBEB automatically blocks incoming messages to recipients not found in Microsoft Entra ID. Changing the domain type to Internal Relay ensures Exchange Online routes unknown recipients to your on-premises environment via the hybrid connector.
Log in to the Microsoft 365 Exchange Admin Center (EAC) using your global administrator credentials.
In the left-hand navigation pane, go to Mail flow and click on Accepted domains.
Select your shared email domain (e.g., contoso.com) from the list and click the Edit button.
Under the domain type options, select 'Internal Relay' instead of 'Authoritative', and save your changes.
Open Microsoft Entra Connect on your on-premises server and verify that all mail-enabled users and contacts are actively synchronizing to Microsoft 365.
Manage Your Documents and Communications with WPS Office
While troubleshooting your Microsoft Exchange server routing settings, consider WPS Office for your daily productivity needs. It offers a lightweight, highly compatible alternative to Microsoft Office, ensuring seamless creation and editing of Word, Excel, and PowerPoint files.
- 1. Visit the Official Website: Navigate to the WPS Office website to access the official, secure free download.
- 2. Download the Installer: Click the download button to get the lightweight installation file for your operating system.
- 3. Install and Launch: Run the installer and follow the on-screen instructions to start using your new office suite immediately.
Frequently Asked Questions
What does the 550 5.4.1 NDR code mean in Exchange Online?
The 550 5.4.1 error indicates that the recipient address was rejected because it does not exist in the Microsoft 365 directory. This is typically caused by Directory-Based Edge Blocking (DBEB) rejecting the email before it can route to your on-premises server.
Why do I need to synchronize my on-premises mailboxes to Microsoft Entra ID?
Synchronizing your on-premises accounts ensures that Microsoft 365 recognizes them as valid recipients. Without this synchronization, Exchange Online's preliminary filtering layers may block incoming mail intended for those specific on-premises users.
What is the difference between Authoritative and Internal Relay domains?
An Authoritative domain indicates that Exchange Online hosts all mailboxes for that domain and will reject emails sent to unknown users. An Internal Relay domain tells Exchange Online that some mailboxes exist elsewhere, prompting it to forward emails for unknown users to your on-premises server.
