Blazalek.com

5.4.1Mail rejected by the destination domain (permanent)

The receiving system reports a permanent, destination-side rejection of the message using the enhanced code 5.4.1: the destination domain's own mail filters, or a recipient-address access policy, refused the message or address in a way this catalog's collected evidence never ties to a literal, unanswered connection attempt. Class 5 makes this a permanent result for the current context.

Category
Network, DNS and routing
Class
Permanent failure
Retry
Do not retry unchanged
Suppression
Check the full context

TL;DR

In production, 5.4.1 means a permanent, destination-side rejection — the receiving domain's own mail filters or its recipient-access policy, not (based on the evidence gathered here) a literal unanswered connection attempt. Do not retry the same message unchanged; reach the recipient or their mail administrator through another channel, and only resend after something has actually changed.

What this code means

This catalog's IANA registry mirror mechanically confirms only the class-4 reading of registry pattern X.4.1 (code 4.4.1). No IANA registry confirmation exists here for any class-5 variant of the pattern, yet code 5.4.1 maps that pattern onto class 5. Under RFC 3463, X.4.1 means "no answer from host" and is useful only as a persistent transient failure. Concrete code 5.4.1 appears in this catalog on exact corpus evidence instead: production responses that carry the digits 5.4.1 yet describe a permanent destination-side rejection, whether through the receiving domain's own mail filters (Zoho) or a recipient-address access policy enforced inside a non-delivery report (Microsoft 365 / Exchange Online Protection), not an unanswered connection.

Technical meaning

Observed provider behavior treats the digits as evidence of a permanent destination-side refusal, not as proof that the standard's exact "no answer from host" condition occurred. Pattern X.4.1 denotes no answer from the remote host: an outbound connection attempt went unanswered because the remote system was busy or unable to accept the call. RFC 3463 states the pattern generically, and this catalog's IANA registry mirror mechanically confirms only the class-4 variant (4.4.1, basic SMTP code 451, a persistent transient failure). No IANA registry mechanism confirms a class-5 variant of X.4.1 here. Concrete code 5.4.1 is published on exact corpus evidence: production responses carrying the digits 5.4.1 that describe a permanent destination-side rejection (a receiving domain's mail filters, or a recipient-address access policy), not the literal unanswered connection attempt the standard describes.

Delivery status

The leading digit 5 denotes a permanent failure for this message in the current context: do not repeat the exact same send unchanged. This does not by itself mean the recipient address is permanently invalid — both accepted examples describe a filter or access-policy decision, which can change if the receiving domain adjusts it. Do not conflate this with 4.4.1, where the same X.4.1 pattern is IANA-confirmed as a class-4, retryable condition describing an unanswered connection.

Class
Permanent failure
Retry
Do not retry unchanged
Suppression
Check the full context

Retry decision

Operational recommendation: stop automatic and manual retries of the same message to this address in the unchanged context. A new send makes sense only after a relevant condition has demonstrably changed — the receiving domain adjusting its filter, or its administrator confirming the recipient-access policy no longer blocks the address — not merely after time has passed.

Suppression decision

Operational recommendation: do not add the address to a suppression list from a single 5.4.1 alone. Inspect the full response text and the system that returned it: a destination-domain filter or a recipient-access policy decision may be reversible by the recipient's administrator and is not the same as a permanently invalid address. Suppress only once the applicable list policy, or an independent permanent signal, justifies it.

Common causes

  • The receiving domain has its own mail filters configured to block this specific message, independent of the sender's own reputation — documented Zoho behavior for domains hosted with this provider.
  • The receiving system's recipient-address access policy denies delivery to this specific address, reported inside a non-delivery report rather than a live SMTP reply — documented Microsoft 365 / Exchange Online Protection behavior.
  • Providers reuse the X.4.1 digits for a permanent destination-side refusal that the standard's own example ("no answer from host") does not describe; the code alone does not identify which filter or policy fired.

Diagnostic steps

  1. Inspect the raw SMTP response or non-delivery report and confirm that the enhanced code is exactly 5.4.1 and the basic reply is in the 5xx class (541 in the accepted Zoho example, 550 in the accepted Microsoft 365 / Exchange Online Protection example).
  2. Read the provider's own description text carefully: it usually names the real cause (destination-domain mail filters, or a recipient-address access policy), which does not have to match the standard's literal "no answer from host" wording for X.4.1.
  3. Correlate the response with the specific message, attempt time, and recipient address or domain; retain the full response text, including any bracketed server or message identifiers the provider includes.
  4. Stop unchanged automated retries; before any new send, confirm with the recipient or their administrator that the underlying filter, policy, or address issue has actually changed.

Actions by owner

Sender administrator

  • Stop automated retries of the same message to this address in the unchanged context; confirm which system (a domain hosted on Zoho, or Microsoft 365 / Exchange Online Protection) returned the exact 5.4.1 response, and retain the full text.
  • If the block looks policy-based rather than address-invalidity (the Zoho wording explicitly names destination-domain filters), reach the recipient through another channel and ask them, or their mail administrator, to check the block; only resend once a relevant condition has demonstrably changed.

Recipient administrator

  • If you administer the receiving domain, check the domain's own mail-filter or recipient-access policy (Zoho: domain-level filters; Microsoft 365 / Exchange Online Protection: recipient-address access policy) for the rule blocking this sender or address.
  • Adjust the filter, allow-list the sender, or confirm the recipient address is correct and active, then tell the sender what changed so they can decide whether to resend.

Provider

  • If you operate the receiving mail platform, confirm which layer produced the 5.4.1 response (a domain-level content/recipient filter vs. a security or access policy) and that the digits reflect a genuine permanent destination-side refusal, not a transient issue mis-coded as permanent.
  • Preserve the exact status code and description text in the response so the sending system does not treat the digits alone as evidence that the standard's literal "no answer from host" condition occurred.

Provider examples

zoho example
smtp;541 5.4.1 Mail rejected by destination domain
Microsoft / Outlook example
550 5.4.1 Recipient address rejected: Access denied. [AMS0EPF0293901AB.eurprd05.prod.outlook.com 2023-01-01T00:00:00.000Z 08DBE74C0FA349500]

Sources

These sources define what this enhanced status code means, mainly through the IANA registry and related RFCs. When provider examples appear on the page, they come from that provider's published documentation. Follow the links to read the original wording in context.

Last verified:

Guide

  • Sending Reliability

    Use SMTP 4xx=retry vs 5xx=permanent for mixed 4.4.x and 5.4.3 path failures.

Wojtek Blazalek

Email deliverability expert

Stuck on this error code? I help teams identify rejection causes and fix authentication and reputation, so email reaches the inbox.

Hands-on deliverability work for teams that send at scale.