EXO: 550 5.4.1 Recipient address rejected: Access denied to Distribution List (Only newer ones)

[Bas Wijdenes]

Hi all,

I have set up a DistributionGroup so that it can also receive external emails.
If I test it from different (external) tenants I get the following error message:

550 5.4.1 Recipient address rejected: Access denied.

I adjusted this about 8 days ago.

After I kept getting this error message I also tested it in other tenants and got the same error message. These are tenants with different domain names and different domain registrars.

• When I compare the properties via PowerShell they're the same.
• When I do a MessageTrace I don't see the emails sent to the DistributionGroup at all.
  So the message is dropped before it arrives at EXO?
• I've tried changing the PrimarySmtpAddress or add an Alias, but none of this worked either. 
• As soon as I change the Accepted Domain from Authoritive to Internal relay the messages do arrive!

When I search for the error message I find the following docs:

https://docs.microsoft.com/en-us/exchange/mail-flow-best-practices/non-delivery-reports-in-exchange-...

None of the steps under 'I'm an email admin. How can I fix this?' is the solution.

Since I have this issue in more tenants I think that it is a global issue at Microsoft.

Can someone please confirm? Or tell me what I do wrong.

[#2]

If you are not getting any results in the message trace and it works when switching to InternalRelay, this is most likely caused by issue with the Directory Based Edge Blocking feature. You can try to trigger the replication by changing the primary SMTP address of the DG (and changing it back if needed), or you can open a support case and have the engineer look at it.

[#3]

Thanks for this. I encountered the same issue and tried adding a dummy smtp alias and it works. Probably on your case it just needed a few hours of global replication. Otherwise, it could be a tenant level service issue.

The blog i've followed (for advance or newbies):
https://www.thedailyexploits.co/ndr-code-550-541-recipient-address-rejected/