SMTP bounce codes and NDR messages explained
191 bounce codes, each with what it means, the likely causes, the fix, and the ProbeKit checks that confirm it: basic SMTP reply codes, the enhanced status codes from RFC 3463 and its successors, and the wording Microsoft, Google, Yahoo, and the big filtering services use.
SMTP reply codes
- 421Service not available, closing transmission channel
- 432A password transition is needed
- 450Requested mail action not taken: mailbox unavailable
- 451Requested action aborted: local error in processing
- 452Requested action not taken: insufficient system storage
- 454TLS not available or temporary authentication failure
- 455Server unable to accommodate parameters
- 500Syntax error, command unrecognized
- 501Syntax error in parameters or arguments
- 502Command not implemented
- 503Bad sequence of commands
- 504Command parameter not implemented
- 521Server does not accept mail
- 530Authentication required
- 534Authentication mechanism is too weak
- 535Authentication credentials invalid
- 538Encryption required for requested authentication mechanism
- 550Requested action not taken: mailbox unavailable
- 551User not local; please try forward-path
- 552Requested mail action aborted: exceeded storage allocation
- 553Requested action not taken: mailbox name not allowed
- 554Transaction failed
- 555MAIL FROM/RCPT TO parameters not recognized or not implemented
- 556Domain does not accept mail
X.0.x other or undefined status
X.1.x addressing status
- 5.1.0Other address status
- 5.1.1Bad destination mailbox address
- 5.1.2Bad destination system address
- 5.1.3Bad destination mailbox address syntax
- 5.1.4Destination mailbox address ambiguous
- 5.1.6Destination mailbox has moved, no forwarding address
- 5.1.7Bad sender’s mailbox address syntax
- 5.1.8Bad sender’s system address
- 5.1.10Recipient address has null MX
X.2.x mailbox status
X.3.x mail system status
X.4.x network and routing status
X.5.x mail delivery protocol status
X.6.x message content or media status
X.7.x security or policy status
- 5.7.0Other or undefined security status
- 5.7.1Delivery not authorized, message refused
- 5.7.2Mailing list expansion prohibited
- 5.7.3Security conversion required but not possible
- 5.7.4Security features not supported
- 5.7.5Cryptographic failure
- 5.7.6Cryptographic algorithm not supported
- 5.7.7Message integrity failure
- 5.7.8Authentication credentials invalid
- 5.7.9Authentication mechanism is too weak
- 5.7.10Encryption needed
- 5.7.11Encryption required for requested authentication mechanism
- 5.7.12A password transition is needed
- 5.7.13User account disabled
- 5.7.14Trust relationship required
- 5.7.20No passing DKIM signature found
- 5.7.21No acceptable DKIM signature found
- 5.7.22No valid author-matched DKIM signature found
- 5.7.23SPF validation failed
- 5.7.24SPF validation error
- 5.7.25Reverse DNS validation failed
- 5.7.26Multiple authentication checks failed
- 5.7.27Sender address has null MX
- 4.7.28Mail flood detected
- 5.7.29ARC validation failure
- 5.7.30REQUIRETLS support required
Microsoft 365 and Outlook.com
Exchange Online (Microsoft 365) and the consumer Outlook.com, Hotmail, and Live services. Their NDRs carry an enhanced status code with a Microsoft-specific detail number (5.7.606, 5.4.310) and often a component name such as RESOLVER or SMTPSEND.
- 550 5.1.8Access denied, bad outbound sender
- 550 5.1.10Recipient not found by SMTP address lookup
- 550 5.1.90Daily recipient limit reached
- 554 5.2.2Mailbox full or submission quota exceeded
- 550 5.2.121Per hour receive limit from one sender exceeded
- 550 5.3.4Message size exceeds fixed maximum size
- 550 5.4.1Recipient address rejected: Access denied
- 554 5.4.14Hop count exceeded, possible mail loop
- 550 5.4.310DNS domain does not exist
- 5.4.312DNS query failed
- 550 5.4.316Message expired, connection refused
- 550 4.4.7Message expired in queue
- 5.6.11Bare linefeeds are illegal
- 550 5.7.1Delivery restriction: authentication required
- 550 5.7.12Sender was not authenticated by organization
- 550 5.7.23Sender Policy Framework violation
- 530 5.7.57Client not authenticated to send anonymous mail
- 550 5.7.64TenantAttribution; Relay Access Denied
- 550 5.7.124Sender not in allowed senders list
- 550 5.7.133Sender not authenticated for group
- 550 5.7.501Access denied, spam abuse detected
- 550 5.7.505Access denied, banned recipient
- 550 5.7.506Access denied, bad HELO
- 550 5.7.507Access denied, rejected by recipient
- 550 5.7.508Access denied, IPv6 range exceeded permitted limits
- 550 5.7.509Access denied, sending domain does not pass DMARC verification
- 550 5.7.510Access denied, recipient does not accept email over IPv6
- 550 5.7.511Access denied, banned sender
- 550 5.7.512Access denied, message must be RFC 5322 section 3.6.2 compliant
- 550 5.7.513Client host blocked using Customer Block list
- 550 5.7.515Access denied, sending domain does not meet the required authentication level
- 550 5.7.520Access denied, your organization does not allow external forwarding
- 550 5.7.606Access denied, banned sending IP
- 550 5.7.705Access denied, tenant has exceeded threshold
- 550 5.7.708Access denied, traffic not accepted from this IP
- 550 5.7.750Client blocked from sending from unregistered domains
- 451 4.7.650Mail server temporarily rate limited due to IP reputation
- 451 4.7.500Server busy, please try again later
- 550 5.7.1 (S3150)Outlook.com network block list
- 550 5.7.1 (S3140)Outlook.com block list (S3140)
Gmail and Google Workspace
Gmail and Google Workspace answer with standard reply and enhanced codes followed by an explanation and a support.google.com link; the reply usually ends in "gsmtp". Since February 2024 they enforce authentication rules for everyone and stricter ones for bulk senders.
- 550 5.7.26Unauthenticated email rejected by the domain’s DMARC policy
- 550 5.7.26Unauthenticated mail blocked (no SPF or DKIM pass)
- 550 5.7.25Sending IP has no matching PTR record
- 421 4.7.28Rate limited for an unusual rate of unsolicited mail
- 550 5.7.1Message likely unsolicited mail
- 550 5.7.1Blocked for very low sending IP or domain reputation
- 421 4.7.0Message deferred as suspicious due to low reputation
- 421 4.7.0TLS required for the recipient domain
- 421 4.7.27Rate limited because SPF did not pass
- 421 4.7.30Rate limited because DKIM did not pass
- 421 4.7.32Rate limited because From is not aligned with SPF or DKIM
- 421 4.7.29Rate limited because the connection did not use TLS
- 550 5.1.1The email account does not exist
- 550 5.2.1The email account is disabled
- 450 4.2.1Recipient is receiving mail too fast
- 552 5.2.2Recipient mailbox over quota
- 552 5.3.4Message exceeds Google’s size limit
- 550 5.4.5Daily sending quota exceeded
- 552 5.7.0Message blocked for a potential security issue
- 554 5.6.0Malformed message not accepted
- 535 5.7.8Username and password not accepted
- 534 5.7.9Application-specific password required
- 534 5.7.14Please log in via your web browser
- 530 5.7.0Must issue a STARTTLS command first
Yahoo Mail and AOL
Yahoo Mail (and AOL, which runs on the same platform) tags many deferrals and rejections with a bracketed code such as [TSS04] or [BL21] that tells you which rule fired.
- 421 4.7.0 [TSS04]Temporarily deferred for unexpected volume or user complaints
- 421 4.7.0 [TSS09]All messages from the IP permanently deferred
- 554 5.7.9Message not accepted for policy reasons
- 550 5.7.9Blocked because the sender is unauthenticated
- 553 5.7.1 [BL21]Connection refused because the IP is on a Spamhaus list
- 421 4.7.0 [GL01]Message temporarily deferred due to unusual traffic
- 554 delivery error: ddUser does not have a Yahoo account
- 554 delivery error: dd (554.30)Mailbox is disabled
Proofpoint
Proofpoint filters inbound mail for many companies, universities, and some mailbox providers. When it rejects you, the bounce comes from the Proofpoint gateway in front of the recipient, not from the recipient’s mail server itself.
Mimecast
Mimecast is a cloud email security gateway. Its rejections are short sentences naming the policy that fired (Anti-Spoofing, Blocked Senders, security policies), which tells the recipient’s admin exactly where to look.
- 550 Rejected by header based Anti-Spoofing policyMimecast header based anti-spoofing rejection
- 550 Anti-Spoofing policy - Inbound not allowedMimecast envelope anti-spoofing rejection
- 550 Envelope blockedMimecast blocked sender entry
- 550 Invalid RecipientMimecast recipient validation failure
- 550 Email rejected due to security policiesMimecast security policy rejection
- 451 Open relay not allowedMimecast open relay refusal
- 451 Internal resources are temporarily unavailableMimecast temporary internal failure
- 451 Recipient temporarily unavailableMimecast temporary recipient deferral
Barracuda
Barracuda Email Security Gateway appliances and the Barracuda cloud service reject on the Barracuda Reputation Block List, on recipient checks, and on per-sender rate limits.
Intermedia hosted Exchange
Intermedia hosts Microsoft Exchange mailboxes for small and mid-sized businesses. Its bounces usually use Exchange wording, while the settings that cause them live in the Intermedia control panel.
Zoho Mail
Zoho Mail rejects both inbound mail and its own users’ outgoing mail. Many Zoho bounces are about your own account being blocked from sending, not about the recipient.
iCloud Mail
iCloud Mail (icloud.com, me.com, mac.com) filters inbound mail with Proofpoint, so its rejections mix Apple bracket codes such as [CS01] with Proofpoint block messages.