5.1.8 bounce: bad sender system address
5.1.8Bad sender’s system addressPermanent: retrying will not help
553 5.1.8 <user@example.com>: Sender address rejected: Domain not found
What it means
RFC 3463 names X.1.8 "Bad sender’s system address". The domain in your envelope sender failed a check on the receiving server. Postfix, for example, rejects senders whose domain has no MX and no A record when reject_unknown_sender_domain is enabled, with text like "Sender address rejected: Domain not found".
Microsoft uses the same code with a very different meaning in Exchange Online: 550 5.1.8 "Access denied, bad outbound sender" means Microsoft blocked one of its own tenant’s accounts from sending because it looked compromised and sent spam. That case has its own page; this one covers the generic DNS-based meaning.
Postfix returns 450 4.1.8 when the domain lookup failed temporarily, and your server will retry. A 5.1.8 means the server got a definite answer that the domain is unusable as a sender.
Likely causes
- The sender domain does not exist in DNS, for example a made-up domain on a test server or a typo in a device setting.
- The sender domain exists but has neither an MX nor an A or AAAA record, so the receiver cannot send bounces back.
- The sender domain uses a local-only name such as `server.local` or `company.internal`.
- The domain’s DNS was broken by an expired registration or a nameserver change.
How to fix it
- Read the sender address in the bounce and check that the domain is a real, public domain you own.
- Publish an MX record for the sending domain, or at least an A record, so receivers can return mail, for example `example.com. 3600 IN MX 10 mail.example.com.`
- Change devices and scripts that use internal names to a public sender address on your domain.
- If your domain expired, renew it and wait for the nameservers to answer again before resending.
- If the bounce says "bad outbound sender" and comes from Microsoft, follow the compromised account steps on the Microsoft page instead.
Checks that apply
- MX Lookup Shows whether your sending domain publishes MX records, the most common thing a 5.1.8 check looks for.
- A Record Confirms the fallback address record that some receivers accept in place of an MX.
- Whois Lookup Reveals an expired sender domain, which suddenly makes every message from it fail with 5.1.8.
- Domain Health Grades the sending domain end to end, catching broken DNS that leads receivers to treat it as invalid.
FAQ
- Does a 5.1.8 mean my account is compromised?
- Only when it comes from Microsoft 365 with "bad outbound sender" text. Elsewhere it means the receiver could not validate your sender domain in DNS.
- Will the sender retry after 5.1.8?
- No, it is permanent. The temporary version, 4.1.8, is the one your server keeps retrying.