550 5.4.316: Microsoft message expired, connection refused
550 5.4.316Message expired, connection refusedPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.4.316 Message expired, connection refused(Socket error code 10061)
What it means
Exchange Online resolved the recipient’s MX fine, but every attempt to open a TCP connection to port 25 was actively refused. Socket error 10061 is the Windows name for a refused connection. Microsoft kept retrying, and when the message passed its expiry time it gave up with 5.4.316. The text usually reads like the example.
Refused is not the same as timed out. A refusal means a host answered and said nothing listens on port 25 there, or a firewall sent a reset. A timeout means nothing answered at all. Both end the same way, but refusal points squarely at the receiving server or its firewall rules.
Likely causes
- The SMTP service on the recipient’s mail server is stopped or crashed.
- A firewall in front of the mail server rejects connections from Microsoft’s IP ranges.
- The MX record points to an old server or an IP that no longer runs mail.
- The recipient moved to a cloud filter but left the MX pointing at a host that only accepts connections from that filter.
How to fix it
- Recipient admin: test port 25 on every MX host from outside your network.
- Start or repair the SMTP service, and check the firewall allows inbound 25 from the internet (or from the providers you route through).
- If the MX is outdated, update it to the current mail host and wait for the TTL to pass.
- Sender: once the recipient confirms the fix, resend the message, because the expired one will not be retried.
Checks that apply
- TCP Port Test Tests whether port 25 on the MX host accepts a connection, which is exactly what failed here.
- SMTP Diagnostics Goes one step further and shows the SMTP banner and STARTTLS once the port opens.
- MX Lookup Lists the MX hosts and their priorities so you can test each one.
FAQ
- How long did Microsoft try before this NDR?
- Exchange Online retries for a period that is typically around a day before it gives up and sends the NDR.
- Is this related to 4.4.7?
- Yes, both are expiry bounces. 5.4.316 adds the reason: the connection was refused every time.