What is the difference between HM08 and CS01?

Neither is documented by Apple. In practice CS01 tends to follow content and reputation, while HM08 tends to follow sender identity: authentication, reverse DNS, and header structure.

Why does Gmail accept my mail when iCloud returns HM08?

Each provider weighs signals differently, and Apple is stricter about some header and identity details. Passing at Gmail tells you the content is acceptable there, not that your setup is complete.

Should I keep resending until it goes through?

No. Repeated attempts from the same setup only add negative history. Fix the identity issue first, then send one test.

554 5.7.1 [HM08]: iCloud Mail policy rejection

554 5.7.1 [HM08]iCloud Mail policy rejection (HM08)Permanent: retrying will not helpFrom iCloud Mail

Example

554 5.7.1 [HM08] Message rejected due to local policy

What it means

HM08 is a bracket tag that Apple’s mail exchangers (mx01.mail.icloud.com and its siblings) attach to a 554 5.7.1 refusal. As with every 5.7.1, the receiving system decided it was not willing to accept this message from this sender. The decision happens while your server is still talking to Apple, so the rejection lands in your own logs and the user at icloud.com, me.com, or mac.com never sees a thing.

Apple keeps the meaning of its tags private. Admins who have chased HM08 down usually found an identity problem rather than a content one: a From header that does not match the domain that actually authenticated, a DKIM signature broken in transit, a sending host without reverse DNS, or headers that look hand-built. Forwarders and small self-hosted servers see it more often than big ESPs do.

Compare it with [CS01], which tends to follow content and reputation, and [HM07], an even less documented sibling. Treat all three as permanent and as your problem to solve as the sender, since Apple gives recipients no way to whitelist around them.

Likely causes

DMARC misalignment: SPF passes for a bounce domain at your ESP, but the visible From domain has no aligned DKIM signature.
Forwarding or a mailing list that edits the subject or footer, which breaks the original DKIM signature while keeping the original From.
A self-hosted server whose IP has no PTR record, or a PTR name that does not resolve back to the same IP.
Malformed headers: a missing Message-ID or Date, two From lines, or raw 8-bit characters in headers without SMTPUTF8.
A HELO or EHLO name that is a bare hostname, an IP literal, or a name that does not exist in DNS.

How to fix it

Check reverse DNS for the IP that connected to Apple and make it forward-confirmed: the PTR name must have an A record that points back to the same address.
Set your server’s HELO name to that same fully qualified name, for example `mail.example.com`, instead of a local machine name.
Sign outbound mail with DKIM using the From domain (d=example.com), not only your provider’s shared domain, so DMARC can align.
If you forward mail into iCloud, rewrite the envelope sender with SRS, or rewrite the From when the list modifies the body.
Make sure every message carries one From, one Date, and a Message-ID, then send a test to an iCloud address you control and read the result.

Checks that apply

Your domain or sending IP (fills in the checks below)

Reverse DNS (PTR) Shows the reverse DNS name of your sending IP and whether it maps back, a common gap behind HM08 on self-hosted servers.
DKIM Check Verifies that the selector in your signature resolves, so you can rule out a missing key before you look at forwarding.
DMARC Check Confirms the From domain publishes DMARC and shows its alignment mode, which decides whether a relaxed match is enough.
Email Header Analyzer Reads a delivered copy so you can spot a duplicate header, a missing Message-ID, or a DKIM failure caused by a list footer.

FAQ

What is the difference between HM08 and CS01?: Neither is documented by Apple. In practice CS01 tends to follow content and reputation, while HM08 tends to follow sender identity: authentication, reverse DNS, and header structure.
Why does Gmail accept my mail when iCloud returns HM08?: Each provider weighs signals differently, and Apple is stricter about some header and identity details. Passing at Gmail tells you the content is acceptable there, not that your setup is complete.
Should I keep resending until it goes through?: No. Repeated attempts from the same setup only add negative history. Fix the identity issue first, then send one test.

All 191 bounce codes