SMTP error 5.4.3 Directory server failure

What SMTP error 5.4.3 means

A lookup the mail system depends on did not answer, so it could not work out what to do with the message. Two different services hide behind this one code: public DNS, and an internal directory such as Active Directory. It appears as 451 while the system is still retrying and as 550 once it has given up. The address itself is fine; the service that has to resolve it was unavailable at the moment of the attempt.

Network and routing status
Sent by The mail system that needed the lookup, which is usually the receiver
Occasional

What SMTP error 5.4.3 Directory server failure actually means

The specification gives an unreachable DNS server as its example, but in a business running Exchange or a hybrid setup the internal directory is the more frequent culprit. Transport needs a domain controller or global catalog to turn a recipient address into an object it can deliver to, and if that lookup fails the message stalls even though everything about the addressing is correct. It is worth holding this apart from 5.4.4 in your head: 5.4.3 means the lookup service did not answer, whereas 5.4.4 means the answer came back and contained no usable route.

The network system was unable to forward the message, because a directory server was unavailable. This is useful only as a persistent transient error. The inability to connect to an Internet DNS server is one example of the directory server failure error.
— RFC 3463

How 5.4.3 appears in a bounce

A server reporting this condition sends it alongside a three-digit reply code, and a bounce prints the two together. The registry lists 550 5.4.3 as the pairing for this status. The registry also lists 451 for this condition, but that belongs with 4.4.3 rather than with this code, because a reply code and the status beside it always agree on whether the failure is temporary or permanent.

The leading 5 is the server's verdict rather than part of the code's identity: it marks this as a permanent failure, which means the sending server has given up and returned the message. The same condition reported as 4.4.3 is the other verdict on the identical problem, so a log showing that form has not produced a bounce yet.

What causes SMTP error 5.4.3 on a business phone system

No domain controller reachable from the transport serviceOn-premise Exchange leans heavily on the global catalog. A controller that is down, unreachable across a site link, or holding a corrupted replica will stop mail flow while everything else in the building appears to work.
Directory synchronisation stale or stoppedWhere Azure AD Connect has not run, a recipient created recently exists on one side of a hybrid and not the other. The receiving system looks the object up, finds nothing to resolve against and reports a directory failure rather than a bad address.
A resolver configured on the mail server that no longer worksServers frequently point at an internal DNS server that was decommissioned or at a forwarder that has been retired. Nothing else on the machine notices until it needs to resolve an external name.
DNSSEC validation failing for the recipient domainA domain whose signing has expired or been misconfigured returns a validation failure to any resolver that checks. To the mail system it looks identical to the directory being broken, and it affects only that one domain.
Recipient verification at a gateway failing to reach the tenantFiltering services that check whether an address exists before accepting mail query the customer directory to do it. When that query cannot be answered, the gateway defers everything rather than risk rejecting valid recipients.

How to fix SMTP error 5.4.3

Run the lookup from the mail server itselfNot from your laptop. Resolve the recipient domain from the server that reported the failure, using the resolvers that server is configured with, and you will usually reproduce the fault in one command.
Check directory synchronisation status and force a runConfirm the sync service is running and when it last completed successfully. A delta sync followed by a retest establishes quickly whether a missing object was the reason.
Verify the DNS servers set on the mail serverThey should be resolvers that can answer both internal and external names reliably, and there should be more than one. Remove any entry pointing at a machine that no longer exists.
Test the failing domain against an independent resolverIf a public resolver answers cleanly and yours does not, the fault is on your side. If both return an error for that domain and no other, the recipient has a DNS problem to fix.
Check domain controller health where mail flow stalls internallyReplication errors, time drift and a controller running out of disk all present as mail queuing without an obvious cause. Fixing the directory fixes the mail, and usually several other complaints at the same time.

Fixing the underlying problem

This page explains the code. These guides walk through the fix in detail.

Questions about SMTP error 5.4.3

Does this mean the email address is wrong?

No. A bad address produces 5.1.1 or 5.1.2. This code says the system could not complete the lookup it needed in order to make any judgement about the address at all, so the address may well be perfectly valid.

It started right after we moved mailboxes. Is that related?

Very probably. Migrations leave objects half-created and directory synchronisation under strain, and a recipient that exists in one directory but not the other produces exactly this. Check sync has completed and that the recipient shows correctly on both sides.

Will the message still be delivered?

If the code arrived as 451 then yes, the sender is holding it and will try again once the lookup succeeds. If it arrived as 550 the message has already been returned and needs sending again after the underlying directory or DNS fault is cleared.

Related SMTP status codes

Source. SMTP error 5.4.3 Directory server failure is defined in RFC 3463 and registered in the IANA SMTP Enhanced Status Codes registry. The causes and fixes above are drawn from our own experience supporting UK business email systems.

All Email delivery & SMTP codes