The Email Server Isnt Available Please Try Again Later Office Online

title	ms.author	author	manager	ms.reviewer	audition	ms.topic	ms.service	ms.localizationpriority	f1.keywords	ms.custom	search.appverid	ms.assetid	clarification
Email non-delivery reports in Commutation Online	jhendr	JoanneHendrickson	serdars		Admin	troubleshooting	o365-administration	high	CSH	MiniMaven	MET150 MOP150	51daa6b9-2e35-49c4-a0c9-df85bf8533c3	Admins can larn about not-delivery reports (too known as NDRs or bounce messages) that are generated in Exchange Online.

Email non-delivery reports in Commutation Online

When there's a trouble delivering an e-mail message that you sent, Microsoft 365 or Office 365 sends an email to let you know. The email you receive is a commitment condition notification, too known as a DSN or bounce message. The well-nigh common blazon is called a non-delivery report (NDR) and they tell you that a message wasn't delivered. Not-delivery tin can be caused by something as simple as a typo in an electronic mail address. NDRs include an error lawmaking that indicates why your email wasn't delivered, solutions to help you go your email delivered, a link to more assist on the spider web, and technical details for administrators. Find out What's included in an NDR?.

Discover my NDR code and get assistance delivering my email

The following table contains the NDR codes (too chosen enhanced status codes) for the most mutual bounce messages and NDRs that you might encounter in Exchange Online.

NDR code	Description	Possible cause	Additional information
432 4.3.2	STOREDRV.Evangelize; recipient thread limit exceeded	The recipient mailbox'southward ability to accept messages is being throttled because it's receiving too many messages likewise quickly. This is done then a single recipient'southward mail processing doesn't unfairly touch on other recipients sharing the same mailbox database.	For more information nigh this by-blueprint throttling, meet Store Driver Fault Isolation Improvements in Exchange 2010 SP1.
four.4.316	Connection refused [Message=Socket error code 10061]	Microsoft 365 or Part 365 is trying to ship a bulletin to an email server outside of Microsoft 365 or Part 365, just attempts to connect to it are declining due to a network connection result at the external server'south location.	This error almost always indicates an issue with the receiving server or network outside of Microsoft 365 or Part 365. The error should also include the IP accost of the server or service that'due south generating the error, which yous tin use to identify the political party responsible for fixing this.
4.4.seven	Bulletin expired	The bulletin in the queue has expired. The sending server tried to relay or evangelize the message, but the action wasn't completed before the message expiration time occurred. This message can as well indicate that a message header limit has been reached on a remote server, or another protocol time-out occurred while communicating with the remote server.	This bulletin normally indicates an event on the receiving server. Cheque the validity of the recipient address, and determine if the receiving server is configured correctly to receive messages. You might have to reduce the number of recipients in the message header for the host most which you lot're receiving this fault. If you send the message again, it's placed in the queue again. If the receiving server is available, the message is delivered. For more information, see Gear up email delivery problems for mistake code 4.4.7 in Exchange Online.
iv.5.3	Likewise many recipients	The bulletin has more 200 SMTP envelope recipients from the aforementioned domain.	An envelope recipient is the original, unexpanded recipient that'south used in the RCPT TO command to transmit the bulletin betwixt SMTP servers. When this mistake is returned by Microsoft 365 or Office 365, the sending server must break up the number of envelope recipients into smaller chunks (chunking) and resend the message.
4.vii.26	Access denied, a bulletin sent over IPv6 [2a01:111:f200:2004::240] must pass either SPF or DKIM validation, this message is not signed	The sending message sent over IPv6 must pass either SPF or DKIM.	For more than information, see Support for bearding inbound email messages over IPv6.
4.7.321	starttls-not-supported: Destination mail server must support TLS to receive mail.	DNSSEC checks have passed, yet upon connection, destination postal service server doesn't respond to the STARTTLS command. The destination server responds to the STARTTLS command, only the TLS handshake fails.	This bulletin usually indicates an upshot on the destination e-mail server. Bank check the validity of the recipient address. Decide if the destination server is configured correctly to receive the messages.
iv.vii.322	document-expired: Destination mail server'southward certificate is expired.	DNSSEC checks have passed, yet upon establishing the connection, the destination mail server provides a document that is expired.	A valid X.509 certificate that isn't expired must be presented. Ten.509 certificates must be renewed later on their expiration, normally annually.
4.seven.323	tlsa-invalid: The domain failed DANE validation.	Records are DNSSEC authentic, just ane or multiple of these scenarios occurred: The destination mail server's certificate doesn't match with what is expected per the authentic TLSA record. Authentic TLSA tape is misconfigured. Destination domain is being attacked. Any other DANE failure.	This message usually indicates an issue on the destination electronic mail server. Check the validity of recipient address and determine if the destination server is configured correctly to receive messages. For more information, come across DANE protocol: updates and operational guidance
4.seven.324	dnssec-invalid: Destination domain returned invalid DNSSEC records	The destination domain indicated it was DNSSEC-authentic, but Substitution Online wasn't able to verify it every bit DNSSEC-accurate.	For more than information, run across Overview of DNSSEC.
four.7.325	certificate-host-mismatch: Remote certificate MUST take a common proper name or subject alternative proper name matching the hostname (DANE)	This happens when the presented certificate identities (CN and SAN) of a destination SMTP target host don't match whatever of the domains or MX host.	This message usually indicates an issue on the destination email server. Cheque the validity of recipient address and determine if the destination server is configured correctly to receive messages. For more information, see How SMTP DNS-based Authentication of Named Entities (DANE) works to secure email communications.
4.vii.500-699	Access denied, delight try again later	Suspicious activity has been detected and sending has been temporarily restricted for further evaluation.	If this activity is valid, this restriction will be lifted shortly.
4.vii.850-899	Admission denied, delight try once more later	Suspicious activity has been detected on the IP in question, and it has been temporarily restricted while it's being further evaluated.	If this activity is valid, this restriction will exist lifted shortly.
5.0.350	Generic fault, x-dg-ref header is besides long, or Requested action not taken: policy violation detected (AS345)	5.0.350 is a generic catch-all error code for a broad variety of not-specific errors from the recipient's e-mail organisation. The specific 10-dg-ref header is also long message is related to Rich Text formatted messages. The specific Requested activity non taken: policy violation detected (AS345) message is related to nested attachments.	For more information, see Set up email commitment bug for error lawmaking 550 five.0.350 in Exchange Online.
five.1.0	Sender denied	A common cause of this NDR is when you utilize Microsoft Outlook to salve an email message as a file, and then someone opened the bulletin offline and replied to information technology. The message belongings merely preserves the legacyExchangeDN aspect when Outlook delivers the message, and therefore the lookup could fail.	Either the recipient address is incorrectly formatted, or the recipient couldn't exist correctly resolved. The first step in resolving this mistake is to cheque the recipient accost, and transport the message again. For more than information, see Set up email delivery issues for error code 5.1.0 in Exchange Online.
5.1.1	Bad destination mailbox accost	This failure might be caused by the post-obit conditions: The recipient's email accost was entered incorrectly past the sender. No recipient's exists in the destination e-mail system. The recipient'due south mailbox has been moved and the Outlook recipient cache on the sender'due south computer hasn't updated. An invalid legacy domain proper name (DN) exists for the recipient'south mailbox Active Directory Domain Service.	This fault typically occurs when the sender of the bulletin incorrectly enters the e-mail address of the recipient. The sender should check the recipient's e-mail address and send again. This error can also occur if the recipient electronic mail accost was right in the past but has changed or has been removed from the destination email system. If the sender of the message is in the same organization as the recipient, and the recipient's mailbox still exists, make up one's mind whether the recipient'south mailbox has been relocated to a new email server. If this is the case, Outlook might not have updated the recipient cache correctly. Instruct the sender to remove the recipient's address from sender'southward Outlook recipient cache and so create a new bulletin. Resending the original message will result in the same failure. For more information, meet Fix email delivery problems for error code 5.1.1 through v.one.20 in Exchange Online.
5.1.viii	Access denied, bad outbound sender	The account has been blocked for sending too much spam. Typically, this problem occurs because the business relationship has been compromised (hacked) by phishing or malware.	For more data, meet Ready electronic mail commitment problems for error lawmaking five.1.eight in Commutation Online.
5.1.10	Recipient not establish	The recipient'due south <SMTP Address> wasn't found by SMTP address lookup.	For more data, come across Set e-mail delivery issues for error code 550 v.1.10 in Exchange Online.
five.one.90	Your message can't be sent because you've reached your daily limit for message recipients	The sender has exceeded the recipient rate limit every bit described in Sending limits.	This could indicate the business relationship has been compromised and is being used to transport spam. For more information, see How to determine whether your account has been compromised.
5.ii.2	Submission quota exceeded	The sender has exceeded the recipient rate limit or the message rate limit as described in Sending limits.	This could indicate the account has been compromised and is being used to send spam. For more than information, come across How to make up one's mind whether your business relationship has been compromised.
five.2.121	Recipient's per hour bulletin receive limit from specific sender exceeded.	The sender has exceeded the maximum number of messages they're allowed to transport per 60 minutes to a specific recipient in Exchange Online.	The automated mailer or sender should try over again later, and reduce the number of letters they send per hour to a specific recipient. This limit helps protect Microsoft 365 or Part 365 users from rapidly filling their inboxes with a large number of messages from errant automated notification systems or other single-sender mail storms.
5.2.122	Recipient'south per hr bulletin receive limit exceeded.	The Microsoft 365 or Office 365 recipient has exceeded the number of letters they can receive per hour from all senders.	The automatic mailer or sender should try again later, and reduce the number of messages they ship per 60 minutes to a specific recipient. This limit helps protect Microsoft 365 and Part 365 users from rapidly filling their inboxes with a big number of messages from errant automated notification systems or other mail storms.
5.3.190	Journaling on-bounds letters to Microsoft 365 or Office 365 not supported when Journaling Archive is disabled.	Journaling on-premises letters to Microsoft 365 or Office 365 isn't supported for this organization because they haven't turned on Journaling Annal in their settings.	A journaling rule is configured in the organization's on-bounds surroundings to periodical on-premises messages to Microsoft 365 or Office 365, only Journaling Archive is disabled. For this scenario to work, the system's Function 365 administrator should either enable Journaling Archive or change the journaling rule to journal messages to a dissimilar location.
5.four.1	Relay Access Denied	The mail server that's generating the mistake doesn't take mail for the recipient'due south domain. This error is caused by mail server or DNS misconfiguration.	For more information, come across Fix email commitment bug for fault code 5.iv.one in Commutation Online.
v.4.ane	Recipient address rejected: Access denied	The recipient's address doesn't exist.	For more data, encounter Use Directory Based Border Blocking to reject messages sent to invalid recipients.
5.4.vi or 5.iv.xiv	Routing loop detected	A configuration error has acquired an email loop. 5.4.6 is generated by on-premises Exchange server (you'll encounter this lawmaking in hybrid environments). 5.four.14 is generated by Exchange Online. Past default, after 20 iterations of an email loop, Exchange interrupts the loop and generates an NDR to the sender of the message.	This error occurs when the delivery of a bulletin generates another message in response. That bulletin and so generates a third message, and the process is repeated, creating a loop. To help protect against exhausting arrangement resources, Exchange interrupts the mail loop later on 20 iterations. Mail loops are typically created because of a configuration error on the sending postal service server, the receiving mail service server, or both. Cheque the sender'southward and the recipient's mailbox rules configuration to determine whether automatic message forwarding is enabled. For more information, come across Fix electronic mail delivery issues for mistake lawmaking 5.four.6 or 5.4.fourteen in Exchange Online.
5.iv.300	Message expired	The e-mail took too long to be successfully delivered, either because the destination server never responded or the sent message generated an NDR mistake and that NDR couldn't be delivered to the original sender.
5.5.0	550 5.5.0 Requested activeness non taken: mailbox unavailable	The recipient's <SMTP Address> domain is @hotmail.com or @outlook.com and information technology wasn't found by SMTP address lookup.	Similar to 550 5.1.10. For more information, see Prepare electronic mail delivery issues for error code 550 5.i.10 in Exchange Online.
5.6.11	Invalid characters	Your email program added invalid characters (blank line feed characters) into a bulletin you lot sent.	For more information, encounter Fix email commitment issues for fault code 5.6.eleven in Exchange Online.
v.7.one	Delivery not authorized	The sender of the bulletin isn't immune to ship messages to the recipient.	This error occurs when the sender tries to send a bulletin to a recipient just the sender isn't authorized to do this. This ofttimes occurs when a sender tries to ship messages to a distribution group that has been configured to accept messages simply from members of that distribution grouping or other authorized senders. The sender must asking permission to send messages to the recipient. This error can also occur if an Commutation send rule rejects a bulletin because the bulletin matched conditions that are configured on the transport dominion. For more than data, encounter Fix email delivery issues for fault code v.7.1 in Substitution Online.
5.7.1	Unable to relay	The sending email system isn't allowed to send a message to an electronic mail system where that e-mail organization isn't the final destination of the bulletin.	This mistake occurs when the sending email organization tries to ship an anonymous message to a receiving email system, and the receiving email system doesn't accept letters for the domain or domains specified in one or more of the recipients. The following are the nearly common reasons for this error: A third political party tries to utilize a receiving email system to send spam, and the receiving email system rejects the attempt. Past the nature of spam, the sender'due south email address might have been forged, and the resulting NDR could have been sent to the unsuspecting sender'south electronic mail address. Information technology's hard to avert this situation. An MX record for a domain points to a receiving email arrangement where that domain isn't accepted. The ambassador responsible for the specific domain name must correct the MX record or configure the receiving email system to accept messages sent to that domain, or both. A sending email system or client that should use the receiving electronic mail arrangement to relay messages doesn't have the correct permissions to practise this. For more information, see Fix email delivery issues for error code five.seven.one in Substitution Online.
5.7.1	Client was not authenticated	The sending email organisation didn't authenticate with the receiving electronic mail system. The receiving email system requires authentication earlier message submission.	This error occurs when the receiving server must be authenticated before message submission, and the sending email system hasn't authenticated with the receiving electronic mail system. The sending email system ambassador must configure the sending email system to authenticate with the receiving electronic mail arrangement for delivery to be successful. For more data, come across Fix electronic mail delivery bug for error code 5.7.1 in Substitution Online.
five.vii.12	Sender was non authenticated by organisation	The sender'due south message is rejected because the recipient accost is set up to reject messages sent from outside of its organization. Merely an email admin for the recipient's organization tin change this.	For more than information, see Fix email delivery issues for error code 5.7.12 in Exchange Online.
five.7.23	The message was rejected because of Sender Policy Framework violation	The destination electronic mail organisation uses SPF to validate entering post, and there'south a problem with your SPF configuration.	For more data, run across Fix email delivery issues for error code five.7.23 in Substitution Online.
5.seven.57	Client was not authenticated to send anonymous post during MAIL FROM	You configured an application or device to send (relay) email messages in Microsoft 365 or Office 365 using the smtp.office365.com endpoint, and at that place'southward a problem with the configuration of the application or device.	For more data, run into Fix email delivery problems for error code five.7.57 in Exchange Online.
v.seven.64	TenantAttribution; Relay Access Denied	You use an inbound connector to receive messages from your on-premises e-mail environment, and something has changed in your on-bounds environment that makes the entering connector's configuration wrong.	For more data, see Fix email delivery issues for error code 5.7.64 in Exchange Online.
5.7.124	Sender not in allowed-senders list	The sender doesn't have permission to send to the distribution group because the sender isn't in the group'southward immune-senders list. Depending how the grouping is set up, even the group'south owner might demand to exist added to the allowed sender list in order to send messages to the grouping.	For more than information, see Fix email delivery issues for error code 5.7.124 in Exchange Online.
v.vii.133	Sender non authenticated for group	The recipient address is a group distribution list that is set upwardly to reject letters sent from outside of its organisation. Just an email admin for the recipient's system or the grouping possessor tin change this.	For more data, see Fix email commitment issues for error code 5.7.133 in Exchange Online.
5.7.134	Sender was not authenticated for mailbox	The recipient address is a mailbox that is fix to reject messages sent from outside of its arrangement. Only an e-mail admin for the recipient's organization can change this.	For more information, see Fix electronic mail delivery bug for fault code 5.7.134 in Exchange Online.
5.7.xiii or 135	Sender was non authenticated for public folder	The recipient address is a public folder that is set up to pass up messages sent from outside of its organization. Only an email admin for the recipient's organisation can change this.	For more information, see Fix e-mail delivery issues for error code 5.7.13 or 5.seven.135 in Exchange Online.
5.vii.136	Sender was not authenticated	The recipient address is a postal service user that is gear up to reject messages sent from outside of its organization. Only an electronic mail admin for the recipient's system can change this.	For more than information, see Fix electronic mail delivery problems for mistake lawmaking 5.vii.136 in Commutation Online.
5.7.25	Access denied, the sending IPv6 address [2a01:111:f200:2004::240] must accept a reverse DNS record	The sending IPv6 address must have a opposite DNS record in order to send electronic mail over IPv6.	For more information, see Support for anonymous inbound electronic mail messages over IPv6.
5.7.321	starttls-non-supported: Destination post server must support TLS to receive mail.	DNSSEC checks have passed, yet upon connexion the destination mail server doesn't respond to the STARTTLS command. The destination server responds to the STARTTLS command, but the TLS handshake fails.	This message commonly indicates an event on the destination mail server. Check the validity of the recipient address and determine if the destination server is configured correctly to receive messages.
v.7.322	certificate-expired: Destination mail server's certificate is expired.	DNSSEC checks take passed, nonetheless upon establishing the connection the destination post server provides a certificate that is expired.	A valid X.509 certificate that isn't expired must exist presented. X.509 certificates must be renewed afterwards their expiration, commonly annually.
v.7.323	tlsa-invalid: The domain failed DANE validation.	Records are DNSSEC accurate but one or multiple of these things occurred: The destination mail service server's document doesn't match with what is expected per the accurate TLSA tape. Accurate TLSA tape is misconfigured. Destination domain is being attacked. The certificate first date is in the future. Any other DANE failure.	This message usually indicates an outcome on the destination mail server. Check the validity of the recipient address and decide if the destination server is configured correctly to receive letters. For more data nearly DANE, see: https://datatracker.ietf.org/medico/html/rfc7671.
5.7.324	dnssec-invalid: Destination domain returned invalid DNSSEC records	The destination domain indicated it was DNSSEC-authentic but Exchange Online wasn't able to verify it as DNSSEC-authentic.	For more information about DNSSEC, come across: Overview of DNSSEC.
5.7.325	certificate-host-mismatch: Remote certificate MUST have a common name or subject alternative proper noun matching the hostname (DANE)	This happens when the presented document identities (CN and SAN) of a destination SMTP target host don't match any of the domains or MX host.	This message ordinarily indicates an result on the destination email server. Check the validity of recipient address and determine if the destination server is configured correctly to receive messages. For more data, see How SMTP DNS-based Authentication of Named Entities (DANE) works to secure email communications.
5.vii.501	Access denied, spam abuse detected	The sending account has been banned due to detected spam action.	For details, see Fix email commitment issues for fault code 451 5.7.500-699 (ASxxx) in Exchange Online. Verify that any account issues have been resolved, and reset its credentials. To restore this account'due south ability to send mail service, contact support through your regular aqueduct.
5.7.502	Access denied, banned sender	The sending account has been banned due to detected spam activity.	Verify that any account issues have been resolved, and reset its credentials. To restore this business relationship's power to send postal service, delight contact back up through your regular channel.
v.seven.503	Access denied, banned sender	The sending account has been banned due to detected spam activity.	Verify that any account bug have been resolved, and reset its credentials. To restore this account's ability to send post, please contact support through your regular channel.
5.7.504	[e-mail@contoso.com]: Recipient accost rejected: Admission denied	The recipient address that you're attempting to contact isn't valid.	Verify the recipient'due south email address, and attempt over again.
v.7.505	Access denied, banned recipient	The recipient that y'all're attempting to contact isn't valid.	If you feel this is in error, contact back up.
5.vii.506	Access Denied, Bad HELO	Your server is attempting to introduce itself (HELO according to RFC 821) equally the server it's trying to connect to, rather than its own fully qualified domain proper noun.	This isn't allowed, and information technology'south characteristic of typical spambot beliefs.
5.7.507	Access denied, rejected by recipient	The IP that yous're attempting to send from has been blocked by the recipient's system.	Contact the recipient in lodge to resolve this upshot.
5.seven.508	Access denied, [$SenderIPAddress] has exceeded permitted limits within $range range	The sender's IPv6 range has attempted to transport too many messages in too short a time period.	Not applicable
5.vii.509	Admission denied, sending domain [$SenderDomain] does not pass DMARC verification	The sender'southward domain in the 5322.From address doesn't pass DMARC.	Not applicable
5.7.510	Access denied, [contoso.com] does non accept email over IPv6	The sender is attempting to transmit a message to the recipient over IPv6, but the recipient doesn't have email messages over IPv6.	Not applicative
5.7.511	Access denied, banned sender	The IP that yous're attempting to ship from has been banned.	To delist the address, e-mail delist@messaging.microsoft.com and provide the full NDR code and IP address to delist. For more than information, see Employ the delist portal to remove yourself from the blocked senders list.
five.seven.512	Access denied, message must be RFC 5322 department three.6.2 compliant	Message was sent without a valid "From" email address.	Office 365 only. Each message must contain a valid electronic mail address in the "From" header field. Proper formatting of this address includes angle brackets around the email address, for example, <security@contoso.com>. Without this address Microsoft 365 or Office 365 will reject the bulletin.
5.7.513	Service unavailable, Customer host [$ConnectingIP] blocked by $recipientDomain using Customer Block list (AS16012607)	The recipient domain has added your sending IP address to its custom blocklist.	The domain that received the email has blocked your sender'southward IP accost. If yous recall your IP accost has been added to the recipient domain's custom blocklist in fault, you lot need to contact them directly and ask them to remove it from the blocklist.
5.7.606-649	Admission denied, banned sending IP [IP1.IP2.IP3.IP4]	The IP that you're attempting to send from has been banned.	Verify that you're following the best practices for email deliverability, and ensure your IPs' reputations oasis't been degraded as a result of compromise or malicious traffic. If you lot believe you're receiving this message in error, y'all can use the self-service portal to request to be removed from this list. For more than information, run into Utilize the delist portal to remove yourself from the blocked senders list.
v.7.700-749	5.seven.705 Access denied, tenant has exceeded threshold, 5.7.708 Access denied, traffic not accepted from this IP	The majority of traffic from this tenant has been detected every bit suspicious and has resulted in a ban on sending power for the tenant.	Ensure that any compromises or open up relays accept been resolved, and then contact back up through your regular channel. For more information, see Fix electronic mail commitment issues for fault codes v.7.700 through 5.7.750 in Exchange Online.
five.7.750	Service unavailable. Client blocked from sending from unregistered domains	A suspicious number of messages from unprovisioned domains is coming from this tenant.	Add and validate any and all domains that you apply to ship electronic mail from Microsoft 365 or Office 365. For more data, meet Fix email commitment issues for mistake codes v.7.700 through v.7.750 in Substitution Online.
northward/a	The message tin't exist submitted because the sender'southward submission quota was exceeded	The user business relationship has exceeded the recipient rate limit (10,000 recipients per solar day).	The account has likely been compromised. For more information, see Fix electronic mail commitment issues for error 'the sender's submission quota was exceeded' in Exchange Online.

Run not-delivery report diagnostics

[!NOTE] This feature requires a Microsoft 365 administrator account. This feature isn't available for Microsoft 365 Regime, Microsoft 365 operated by 21Vianet, or Microsoft 365 Germany.

To learn more about the clarification of the not-delivery report (NDR), possible cause, and solution by running the following NDR diagnostic, you can run an automated diagnostic. Make sure you get the NDR code or status code from the undeliverable/non-delivery report.

To run the diagnostic check, select the following button:

[!div class="nextstepaction"] Run Tests: NDR diagnostics

A flyout page opens in the Microsoft 365 admin middle. Paste the NDR code or error message, and so select Run Tests.

What's included in an NDR?

Exchange NDRs are designed to exist easy to read and sympathize by e-mail users and administrators. At that place are a couple of unlike formats for NDRs. The newest way NDR contains a problem clarification in everyday language, along with steps to fix information technology. The following figure shows the format for this type of NDR.

Data provided in the newest style NDRs is designed to help the typical electronic mail user solve their problem immediately. When that isn't possible, the NDR provides details for administrators and also a link to more help on the web. The post-obit fields appear in the newest Office 365 NDRs.

Field	Description
Office 365 logo	This indicates that Microsoft 365 or Office 365 generated the NDR. The logo doesn't mean that Microsoft 365 or Office 365 was responsible for the error. This tells which messaging endpoints or services are involved in the e-mail transaction, which isn't ever articulate in older fashion NDRs.
Crusade	This section provides the reason that the message wasn't delivered.
Fix-it possessor indicator	This section provides an at-a-glance view of the upshot and who needs to prepare it. The image shows the three bones parties in a Microsoft 365 or Part 365 electronic mail transaction: the sender, Microsoft 365 or Office 365, and the recipient. The area marked in red is where the trouble usually must be fixed.
How to prepare it	This section is designed for the end-user or the email sender who receives the NDR. It explains how to fix the issue.
More info for email admins	This department provides a detailed explanation of the problem and solution along with technical details and a link to a web-based commodity that has detailed reference information.
Message hops	This department contains times and arrangement references for the bulletin, which allows an admin to follow the message's hops or server-to-server path. With this info, an admin might quickly spot problems betwixt message hops.

For NDRs that don't have the latest format, the data might be separated into 2 sections: User data, and Diagnostic information for administrators. The following figure shows the format for 1 type of Commutation Online NDR.

User information

The user information section appears first in some NDRs, and the chief purpose is to provide a summary well-nigh what went wrong. The text is designed to help the message sender determine why the message was rejected and, if possible, how to resend the message successfully. The electronic mail address of each recipient is listed, and the reason for the failure is included in the infinite beneath the recipient's email address. The proper noun of the mail service server that rejected the message might also be included in this department.

Diagnostic data for administrators

The Diagnostic information for administrators department provides deeper technical information to help administrators troubleshoot the bulletin delivery problem. It contains detailed information nigh the specific error that occurred during delivery of the bulletin, the server that generated the NDR, and the server that rejected the message. This section uses the following format:

              Diagnostic data for administrators Generating server: <server name>           <rejected recipient>           <remote server>            <enhanced status code>  <SMTP response> Original message headers <message header fields>                          

Field	Description
Generating server	This field indicates the proper name of the SMTP mail server that created the NDR. If no remote server is listed below the sender'south email address, the generating server is also the server that rejected the original email message. When the remote postal service server acknowledges and accepts the message, but later rejects the message, for example, because of content restrictions, the remote server generates the NDR. If the remote mail server never acknowledges and never accepts the bulletin, the sending server in Exchange Online generates the NDR.
<Rejected recipient>	This value is the email address of the recipient. If commitment failed to more than than one recipient, the electronic mail address for each recipient is listed. The following information is also included for each failed recipient: Field Description
<Remote server>	This value is the proper name of the mail server that rejected the message. If the original message is successfully acknowledged past the receiving server, but is later rejected, the remote server value isn't populated.
<Enhanced status code>	This value is assigned by the mail server that rejected the original message and indicates why the message was rejected. These codes are defined in RFC 3463, and apply the format abc ten.y.z, where the placeholder values are integers. For example, a five.10.x code indicates a permanent fault, and a 4.x.ten code indicates a temporary mistake. Although the enhanced status code is frequently generated by an external mail server, Exchange Online uses the enhanced status code value to determine the text to display in the user data section.
<SMTP response>	This value is returned by the mail server that rejected the original bulletin. This text provides an explanation for the enhanced status code value. The text is e'er presented in The states-ASCII format.
Original bulletin headers	This section contains the message header fields of the rejected message. These header fields can provide useful diagnostic data, such equally the path that the message took before it was rejected, or whether the To field value matches the rejected recipient value.

How to translate an Exchange NDR

Hither's an case. Suppose you receive an Exchange NDR that contains the following information:

              Delivery has failed to these recipients or groups: ronald@contoso.com Your message wasn't delivered due to a permission or security issue. Information technology might take been rejected by a moderator, the accost might only accept electronic mail from certain senders, or some other brake might be preventing commitment. The following organization rejected your bulletin: mail.contoso.com. Diagnostic information for administrators: Generating server: alpineskihouse.com ronald@contoso.com mail service.contoso.com #<commutation.contoso.com #5.seven.i smtp;530 5.vii.1 Client was non authenticated> #SMTP# Original message headers: ...                          

From the user information section, yous can make up one's mind that the recipient is Ronald Slattery, and that the message was rejected by the mail server post.contoso.com, which isn't an Exchange Online or Exchange Online Protection mail server.

From the Diagnostic data for administrators section, you can see that alpineskihouse.com attempted to connect to the server mail.contoso.com to deliver the message to the recipient ronald@contoso.com. However, mail.contoso.com responded with the error 530 v.7.one Client was non authenticated. Fifty-fifty though bigfish.com generated the NDR, mail.contoso.com actually rejected the message, so the administrators at contoso.com are responsible for agreement and fixing the problem. This particular error indicates that the server post.contoso.com is configured not to have anonymous e-mail from the Cyberspace.

Although the Original message headers are omitted from this instance due to their length and complexity, you tin typically excerpt useful information from the following header fields:

• To: This field might be helpful if the email accost was mistyped.

• Received: These fields can tell y'all what the path was for the bulletin, and the final hop that generated the delivery status notification if information technology isn't like shooting fish in a barrel to tell from the Generating server value in the NDR.

• Received-SPF: If this value is anything other than laissez passer, cheque the Sender Policy Framework (SPF) DNS tape for your domain. For more information, come across Add together or edit custom DNS records.

Even so demand help with NDRs or other status notifications?

perkinswhered.blogspot.com

Source: https://github.com/MicrosoftDocs/OfficeDocs-Exchange/blob/public/Exchange/ExchangeOnline/mail-flow-best-practices/non-delivery-reports-in-exchange-online/non-delivery-reports-in-exchange-online.md

Share this post