ProbeKit
Sign inSign up

5.5.1 bounce: invalid command

5.5.1Invalid commandPermanent: retrying will not help

Example
503 5.5.1 Error: need MAIL command

What it means

X.5.1 is the RFC 3463 code for “invalid command”: the receiving server did not accept a command because it is not supported or is out of sequence. It normally rides on a 500, 502 or 503 basic reply. Postfix, for example, answers 503 5.5.1 when RCPT TO arrives before MAIL FROM.

This is different from 5.5.2 (the command was understood but its syntax is wrong) and 5.5.4 (the arguments are invalid). With 5.5.1 the verb itself, or its position in the conversation, is the problem.

You almost never see 4.5.1, because a command sent in the wrong order will be just as wrong on the next attempt. When 5.5.1 shows up in a bounce report it usually points at the sending software, not at the recipient.

Likely causes

  • A client issuing RCPT TO or DATA without a successful MAIL FROM first, often after an earlier command failed and the client did not notice.
  • Sending AUTH on a server or port that does not advertise it, or before STARTTLS when the server only offers AUTH over TLS.
  • Pipelined commands sent to a server that did not list PIPELINING in its EHLO response.
  • A nested MAIL FROM inside an open transaction because the client forgot to send RSET between messages.

How to fix it

  1. Find the exact command that drew the 5.5.1 reply in your MTA or application log; the reply text (for example “need MAIL command”) names the missing step.
  2. Check the EHLO response of the receiver and only use extensions it lists. If AUTH appears only after STARTTLS, upgrade the connection before authenticating.
  3. Make your client check every reply code and stop the transaction on a failure instead of carrying on with the next command.
  4. Send RSET (or open a new connection) before starting a second message on the same session.

Checks that apply

  • SMTP Diagnostics Shows the extensions the server advertises before and after STARTTLS, which tells you whether AUTH or PIPELINING is actually on offer.
  • TCP Port Test Confirms you are reaching the intended port (25, 465 or 587), since submission and relay ports accept different command sets.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Will my server retry a 5.5.1?
No. It is a permanent reply, and repeating the same command order would fail again. Fix the client and send the message once more.
Why do I get 5.5.1 only on port 25?
Many servers do not offer AUTH on port 25 to outside clients. Use the submission port 587 with STARTTLS, or 465 with implicit TLS, for authenticated sending.

All 191 bounce codes