ProbeKit
Sign inSign up

SMTP 502: command not implemented

502Command not implementedPermanent: retrying will not help

Example
502 5.5.1 VRFY command is disabled

What it means

RFC 5321 defines 502 as "Command not implemented". The command is valid SMTP, but this server has chosen not to support it, either because the feature is not built in or because the administrator disabled it.

Typical cases are VRFY and EXPN, which many sites disable to stop address harvesting, and TURN or ETRN on servers that do not offer them. Some submission servers reply 502 to AUTH on a port or connection where authentication is not offered, for example before STARTTLS.

It is different from 500, where the server does not recognise the command at all, and from 504, where it knows the command but not the specific parameter (such as an AUTH mechanism name). The usual enhanced code is 5.5.1, "Invalid command".

Likely causes

  • A client or script uses VRFY or EXPN to check addresses on a server that has them disabled.
  • The client tries AUTH on port 25 or before STARTTLS, where the server does not advertise authentication.
  • A device sends an old or optional command like TURN, ETRN, or HELP that the server does not offer.
  • A firewall or SMTP proxy in front of the server filters commands it does not like and answers 502 itself.

How to fix it

  1. Check the EHLO response: only commands and extensions listed there (plus the RFC 5321 basics) should be used.
  2. Do not rely on VRFY to validate addresses; send to the address and handle the RCPT TO reply instead.
  3. For AUTH, connect to the submission port (587 with STARTTLS or 465 with implicit TLS) and issue STARTTLS before AUTH.
  4. If a middlebox is answering, test from outside it and ask the network team to stop it rewriting SMTP commands.

Checks that apply

  • SMTP Diagnostics Prints the EHLO extension list, so you can see whether AUTH is offered and which optional commands the server supports.
  • TCP Port Test Checks whether the submission ports are open, which matters when AUTH works on 587 but returns 502 on 25.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Can I validate addresses with VRFY?
Rarely. Most public servers disable it and answer 502 or 252, so the reliable test is the reply to RCPT TO during a real delivery.
Does 502 mean my mail bounced?
Usually not. It refuses one command; a mail transaction can still succeed if the client continues with supported commands.

All 191 bounce codes