When sending an email to an HES/HES - Inbound Filtering user, the sender receives a Non-Delivery Receipt with the following SMTP error:
554 5.7.1 : Recipient address rejected: Access denied.
The issue only occurs on specific email addresses.
The issue happens when the Directory Management or the Active Directory (AD) Sync client is enabled. Both of these features use LDAP directories.
HES/HES - Inbound Filtering users must make sure that the recipient email address is valid. The email address should be added to the list uploaded or on the Directory Management feature, or synchronized with the AD Sync client.
Directory Management is the feature of HES/HES - Inbound Filtering that uses LDAP directories to help prevent backscatter or "outscatter" spam and Directory Harvest Attacks (DHA). By importing LDAP directories, HES/HES - Inbound Filtering recognizes legitimate email addresses and domains in your organization.
To know more information about the AD Sync client, check out the Web Services manual available on the HES/HES - Inbound Filtering console.