Most common causes
- The application attempted anonymous relay against an authenticated submission endpoint
- Stored credentials are invalid, expired or no longer accepted
- The device or application is using a legacy submission configuration
- The chosen Microsoft 365 relay method does not match the network and identity setup
What to verify next
- Identify the exact endpoint, port and authentication method in use
- Inventory the application or device as an email dependency
- Separate client submission from connector-based relay before changing settings
- Test the replacement path with a controlled message before production use
Best diagnostic path
Live analysis
Mail Failure Doctor
Classify the complete rejection and preserve provider-specific diagnostic context.
Open analysis → Live analysisEmail Dependency Discovery
Map applications and devices that depend on a relay or submission path before changing it.
Open analysis → Live analysisEmail Infrastructure Digital Twin
Map the domain’s public mail infrastructure and provider relationships before remediation.
Open analysis →Why the exact message matters
The same status family can be triggered by different conditions, and providers frequently add diagnostic text that narrows the issue. Use the complete rejection text rather than treating the numeric code as a complete diagnosis.
Provider reference
For the provider-defined meaning and current requirements, review Microsoft Exchange Online NDR reference.