SMTP Reply Codes and Email Bounce Cheat Sheet

When an email fails, the receiving server says why in a short line of text: a three-digit SMTP reply code, usually followed by an enhanced status code such as 5.7.26 and a human-readable message. That line ends up in the bounce message (also called an NDR, non-delivery report) or in your mail server’s log. This sheet decodes those codes, lists the rejection phrases you will see from Gmail and Microsoft, explains SPF, DKIM and DMARC results in message headers, and shows how to test an SMTP server by hand.

Placeholders: DOMAIN is your sending domain. MAIL_HOST is a mail server host name (for example mail.example.com). SENDER@DOMAIN and RECIPIENT@EXAMPLE.NET are the envelope addresses. USERNAME and PASSWORD are your mailbox login. SENDING_IP is the IP address your mail leaves from. SELECTOR is your DKIM selector.

Reading a bounce line

550 5.1.1 <RECIPIENT@EXAMPLE.NET>: Recipient address rejected: User unknown
|   |     |
|   |     +-> free text from the receiving server (wording varies)
|   +-------- enhanced status code: class.subject.detail (RFC 3463)
+------------ basic SMTP reply code (RFC 5321)

First digit	Meaning	What the sending server does	What you do
2	Success	Moves on	Nothing.
3	Intermediate: send more (for example 354 after DATA, 334 during AUTH)	Continues the conversation	Nothing.
4	Temporary failure (soft bounce, deferral)	Queues the message and retries for a period set by the sending server	Usually wait. Repeated 4xx for days means a real problem, often reputation or rate limits.
5	Permanent failure (hard bounce)	Stops and returns a bounce to the sender	Fix the cause before resending. Repeated sends to hard-bounced addresses damage reputation.

The second digit of the basic code groups the topic: x0x syntax, x1x information, x2x connection, x5x the mail system. In the enhanced code, the class (2, 4 or 5) matches the first digit, and the subject number names the area: 1 address, 2 mailbox, 3 mail system, 4 network and routing, 5 protocol, 6 content and media, 7 security and policy.

Basic SMTP reply codes

Code	Meaning	Typical real-world cause
220	Service ready (greeting)	Normal start of a session.
221	Closing connection	Reply to QUIT.
235	Authentication successful	Reply to a good AUTH.
250	Requested action OK	After EHLO, MAIL FROM, RCPT TO and after the message is accepted.
251	User not local; will forward	Rare.
252	Cannot verify user, will attempt delivery	Reply to VRFY, which most servers disable.
334	Authentication challenge	Server waiting for Base64 credentials.
354	Start mail input; end with a line containing only .	Reply to DATA.
421	Service not available, closing connection	Rate limiting, too many connections, server shutting down, reputation throttling.
450	Mailbox unavailable (temporary)	Greylisting, mailbox busy or locked, temporary policy block.
451	Local error in processing	Receiving server problem: DNS lookup failure, content scanner down, greylisting.
452	Insufficient system storage	Receiving server’s disk full, or too many recipients in one message.
454	TLS not available, or temporary authentication failure	Certificate or TLS configuration problem on the server.
500	Syntax error, command unrecognized	Broken client, or a firewall mangling the session.
501	Syntax error in parameters	Malformed address, for example a missing < > or a bad EHLO name.
502	Command not implemented	Command disabled on this server.
503	Bad sequence of commands	Sending RCPT TO before MAIL FROM, or mail before required AUTH.
504	Command parameter not implemented	Unsupported AUTH mechanism or extension.
521	Server does not accept mail	Host deliberately accepts no mail (RFC 7504).
530	Authentication required	Trying to send through a submission server without logging in.
535	Authentication credentials invalid	Wrong username or password, an app password required, or basic authentication disabled by the provider.
550	Mailbox unavailable, or rejected by policy	The catch-all permanent failure: unknown user, spam block, authentication failure. Read the enhanced code.
551	User not local	Rare.
552	Exceeded storage allocation	Recipient mailbox full or message too large.
553	Mailbox name not allowed	Invalid address syntax, or the server will not relay for this sender.
554	Transaction failed	Generic permanent rejection, often spam or blocklist related. As a greeting it means “no SMTP service here”.
556	Domain does not accept mail	Recipient domain publishes a null MX (RFC 7504, RFC 7505); often paired with 5.1.10.
555	MAIL FROM or RCPT TO parameters not recognized	Client sent an extension the server does not support.

Enhanced status codes: address and mailbox (X.1 and X.2)

Code	Official meaning	Real-world cause	Fix
5.1.1	Bad destination mailbox address	The address does not exist: typo, person left, mailbox deleted.	Check spelling. Remove from lists.
5.1.2	Bad destination system address	The domain does not exist or has no mail servers.	Check the domain spelling and its MX records.
5.1.3	Bad destination mailbox address syntax	Malformed address (spaces, missing parts).	Correct the address.
5.1.6	Destination mailbox has moved, no forwarding address	Address retired.	Ask for the new address another way.
5.1.8	Bad sender’s system address	Your envelope sender domain does not resolve or has no MX or A record.	Fix the sending domain’s DNS.
5.1.10	Recipient address has null MX (RFC 7505)	The recipient domain publishes MX 0 ., meaning it accepts no mail. Microsoft 365 also uses 5.1.10 for “recipient not found by SMTP address lookup”.	Check the address. With Microsoft, treat it like 5.1.1.
4.2.1 / 5.2.1	Mailbox disabled, not accepting messages	Account suspended or disabled; with 4.2.1, some providers mean the recipient is receiving mail too fast.	Use another address; for 4.2.1 retry later.
4.2.2 / 5.2.2	Mailbox full	Recipient over quota. 4.2.2 will be retried; 5.2.2 bounces.	Recipient must free space.
5.2.3	Message length exceeds administrative limit	Attachment too large for the recipient’s limit.	Send a link instead of the file.
5.3.4	Message too big for system	Message exceeds the server’s maximum size.	Reduce size.

Enhanced status codes: network and routing (X.4)

Code	Official meaning	Real-world cause	Fix
4.4.1	No answer from host	Recipient’s MX did not respond: down, firewalled, or the sending server cannot reach port 25.	Check MX records and that outbound port 25 is open from the sending server.
5.4.1	No answer from host (registry meaning)	Microsoft 365 uses 550 5.4.1 Recipient address rejected: Access denied when Directory-Based Edge Blocking rejects an address that does not exist in the tenant.	Confirm the recipient exists. Hybrid setups: check directory sync.
4.4.2	Bad connection	Connection dropped mid-session.	Usually retried automatically.
4.4.3	Directory server failure	DNS lookup for the recipient domain failed temporarily.	Check the sending server’s resolver.
5.4.4	Unable to route	No usable MX or A record for the recipient domain.	Check the recipient domain’s DNS.
5.4.6	Routing loop detected	Two servers forwarding to each other, or MX pointing back at the sender.	Review forwarding rules and MX records.
4.4.7 / 5.4.7	Delivery time expired	Sending server gave up after retrying a deferral for too long.	Look at the earlier 4xx reason in the log.

Enhanced status codes: security and policy (X.7)

Code	Official meaning	Real-world cause	Fix
4.7.0	Other or undefined security status (temporary)	Throttling, temporary reputation block, TLS requirements not met, or the receiver could not complete a check.	Slow the sending rate; check TLS and authentication; retry.
4.7.1	Delivery not authorized (temporary)	Greylisting (“Greylisted, please try again”), temporary policy block.	A correctly configured server retries and succeeds. Persistent 4.7.1 points to reputation.
5.7.0	Other or undefined security status	Generic policy rejection.	Read the text.
5.7.1	Delivery not authorized, message refused	Spam filter rejection, sending IP on a blocklist, relaying denied, recipient only accepts mail from certain senders.	Check blocklists for SENDING_IP, the message content and the recipient’s restrictions.
5.7.8	Authentication credentials invalid	Bad SMTP login (often with 535).	Check credentials, app passwords, and whether the provider still allows SMTP AUTH.
5.7.9	Authentication mechanism is too weak	The server refuses the mechanism offered, often a plaintext one without TLS.	Use TLS and a supported mechanism.
5.7.13	User account disabled	The sending account is disabled.	Re-enable the account.
5.7.20	No passing DKIM signature found	Message unsigned or signature broken.	Enable DKIM signing for DOMAIN.
5.7.21	No acceptable DKIM signature found	Signature present but not acceptable to the receiver (for example weak key).	Use a 2048-bit key and a current algorithm.
5.7.22	No valid author-matched DKIM signature found	Signed by a domain other than the From domain.	Sign with d=DOMAIN.
5.7.23	SPF validation failed	SENDING_IP not listed in the SPF record and the policy is -all.	Add the sending service to SPF.
5.7.24	SPF validation error	SPF record broken: syntax error, more than one record, or more than 10 DNS lookups.	Repair and flatten the SPF record.
5.7.25	Reverse DNS validation failed	No PTR for SENDING_IP, or the PTR name does not resolve back to that IP.	Ask whoever controls the IP (your host) to set a matching PTR.
5.7.26	Multiple authentication checks failed	Gmail uses it for unauthenticated mail and for DMARC policy rejections.	Fix SPF and DKIM so at least one passes and aligns with the From domain.
5.7.27	Sender address has null MX	Your envelope sender domain publishes MX 0 ., so it could never receive a reply.	Send from a domain that accepts mail.

Gmail rejection phrases

Gmail bounces end with gsmtp and usually include a link to Google’s help pages. The phrases below are the key words to search for; exact wording changes over time.

Code	Key phrase	Meaning and fix
550 5.1.1	“The email account that you tried to reach does not exist”	No such Gmail or Workspace user. Check the spelling.
550 5.2.1	“The email account that you tried to reach is disabled”	Account suspended. Use another address.
450 4.2.1	“receiving mail at a rate that prevents additional messages from being delivered”	Recipient is getting too much mail. Retry later.
550 5.7.1	“likely unsolicited mail”	Content or reputation spam block. Check Postmaster Tools, content and list hygiene.
550 5.7.25	“does not have a PTR record setup”	Fix reverse DNS for SENDING_IP.
550 5.7.26	“the sender is unauthenticated” and “Gmail requires all senders to authenticate with either SPF or DKIM”	Neither SPF nor DKIM passed.
550 5.7.26	“Unauthenticated email from DOMAIN is not accepted due to domain’s DMARC policy”	DMARC failed and the domain’s policy is reject. Often a third-party sender not set up, or forwarding.
421 4.7.28	“unusual rate of unsolicited email” or “temporarily rate limited”	Reputation or volume throttling for your IP or domain. Slow down and investigate complaints.

Google’s sender guidelines (in force since February 2024) require every sender to personal Gmail accounts to pass SPF or DKIM. Bulk senders, which Google defines as sending close to 5,000 or more messages to personal Gmail accounts within 24 hours, must also set up SPF and DKIM and publish a DMARC record, align the From domain with SPF or DKIM, and support one-click unsubscribe for marketing mail. Google asks all senders to keep the user-reported spam rate in Postmaster Tools below 0.1% and never let it reach 0.3% or higher. Thresholds change; check Google’s current Email sender guidelines.

Microsoft 365 and Outlook.com rejection phrases

Code	Key phrase	Meaning and fix
550 5.1.10	“RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup”	The address does not exist in that Microsoft 365 tenant.
550 5.4.1	“Recipient address rejected: Access denied”	Directory-Based Edge Blocking: the recipient does not exist. Not a sender permission problem.
550 5.7.1	“part of their network is on our block list”	Outlook.com has blocked the sending IP range (the text often ends with a code such as S3150). The IP owner, usually your host, requests delisting through Microsoft’s Outlook.com sender support process.
550 5.7.23	“Sender Policy Framework violation”	SPF failed. Add the sending service to SPF.
550 5.7.509	“does not pass DMARC verification and has a DMARC policy of reject”	DMARC failure on a domain with p=reject.
550 5.7.515	“Access denied, sending domain DOMAIN does not meet the required authentication level”	Outlook.com requirement for domains sending more than 5,000 messages a day (enforced from May 2025): SPF and DKIM must pass and a DMARC record must exist.
550 5.7.606 to 5.7.649	“Access denied, banned sending IP”	The IP is on Microsoft’s block list. Request delisting through Microsoft’s delist portal (sender.office.com).
550 5.7.708	“Access denied, traffic not accepted from this IP”	Sending IP has poor reputation; common for new tenants or compromised accounts.
550 5.4.14	“Hop count exceeded”	Mail loop, usually forwarding or connector misconfiguration.

SPF, DKIM and DMARC results in Authentication-Results

The receiving server adds an Authentication-Results header (RFC 8601). Find it in Gmail with “Show original”, in Outlook with “View message source” or message details.

Authentication-Results: mx.google.com;
       dkim=pass header.i=@example.com header.s=SELECTOR header.b=Ab12Cd34;
       spf=pass (google.com: domain of bounce@example.com designates 192.0.2.25 as permitted sender) smtp.mailfrom=bounce@example.com;
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.com

Result	SPF meaning (RFC 7208)	DKIM meaning	DMARC meaning
pass	Sending IP is authorized for the envelope sender domain	Signature verified	SPF or DKIM passed and aligned with the From domain
fail	IP explicitly not authorized (-all)	Signature did not verify (message altered, wrong key)	Neither aligned SPF nor aligned DKIM passed
softfail	IP probably not authorized (~all)	Not used	Not used
neutral	Domain makes no assertion (?all)	Signed, but the signature had syntax errors or could not be processed	Not used
none	No SPF record found	Message not signed	No DMARC record for the From domain
temperror	Temporary DNS error during the check	Temporary error, such as a key lookup timeout	Temporary error
permerror	Record broken: syntax error, more than one SPF record, or more than 10 DNS lookups	Signature cannot be processed (malformed, missing key)	DMARC record malformed
policy	Rare: the check ran but local policy rejected the result (RFC 8601)	Signed, but some aspect of the signature was not acceptable to the receiver	Not used

Alignment is what DMARC adds. SPF checks the envelope sender (shown as smtp.mailfrom and in Return-Path); DKIM checks the d= domain (header.i or header.d). DMARC passes only if at least one of those passes and uses the same domain as the visible From address (or the same organizational domain in relaxed mode). That is why a message can show spf=pass and still fail DMARC: the third-party sender’s own bounce domain passed, not yours.

Reading Received headers bottom-up

Every server that handles a message adds a Received line at the top of the headers. So the bottom-most Received header is where the message started, and the top one is the last hop, your own provider.

Received: from mail.sender-host.example (mail.sender-host.example [192.0.2.25])
        by mx.recipient.example with ESMTPS id abc123
        for <RECIPIENT@EXAMPLE.NET>; Sat, 07 Nov 2026 10:02:14 +0000   <- read last (newest)
Received: from app.example.com (app.example.com [198.51.100.7])
        by mail.sender-host.example with ESMTPSA id def456;
        Sat, 07 Nov 2026 10:02:11 +0000                                <- read first (oldest)

What to look at	Why
from NAME (RDNS [IP])	The name the sender claimed and the IP and reverse DNS the receiver actually saw. The bracketed IP is the trustworthy part.
by HOST	Which server added this line.
with ESMTPS / ESMTPSA	S means TLS was used; A means the client authenticated.
Timestamps	Compare consecutive hops to find where a delay happened (watch time zone offsets).
Trust	Only lines added by servers you trust are reliable. Anything below the first unknown server could be forged.

Testing SMTP by hand

Use port 587 from home. Many home and mobile ISPs block outgoing connections to port 25 to stop infected computers sending spam, so a test to port 25 can fail even though the server is fine. Port 587 (submission with STARTTLS and login) and 465 (submission with TLS from the start) are meant for mail clients and are rarely blocked. Test port 25 (server-to-server delivery) from a server instead.

# Build the AUTH PLAIN string (NUL, username, NUL, password, Base64 encoded):
printf '\0%s\0%s' 'USERNAME' 'PASSWORD' | base64

# Connect with STARTTLS on the submission port:
openssl s_client -connect MAIL_HOST:587 -starttls smtp -servername MAIL_HOST -crlf -quiet

-crlf sends proper SMTP line endings. -quiet also turns off s_client’s single-letter commands; without it, a line starting with a capital R (as in RCPT TO) can trigger a TLS renegotiation and a line starting with Q quits. Then type (server replies shown indented):

EHLO test.DOMAIN
    250-MAIL_HOST
    250-AUTH PLAIN LOGIN
    250 SIZE 52428800
AUTH PLAIN BASE64_STRING
    235 2.7.0 Authentication successful
MAIL FROM:<SENDER@DOMAIN>
    250 2.1.0 Ok
RCPT TO:<RECIPIENT@EXAMPLE.NET>
    250 2.1.5 Ok
DATA
    354 End data with <CR><LF>.<CR><LF>
From: SENDER@DOMAIN
To: RECIPIENT@EXAMPLE.NET
Subject: SMTP test

This is a test.
.
    250 2.0.0 Ok: queued as 4F2A1B
QUIT
    221 2.0.0 Bye

BASE64_STRING is the output of the printf line. Exact server replies differ; the codes are what matter. The blank line after Subject separates headers from the body, and the lone . ends the message.

Port	Use	TLS	Test with
25	Server to server delivery (MX)	Optional STARTTLS	openssl s_client -connect MX_HOST:25 -starttls smtp -crlf -quiet from a server
587	Submission by mail clients and websites, with login	STARTTLS	openssl s_client -connect MAIL_HOST:587 -starttls smtp -crlf -quiet
465	Submission with TLS from the first byte	Implicit TLS	openssl s_client -connect MAIL_HOST:465 -crlf -quiet

Common recipes

Website contact form mail is bouncing or vanishing

dig DOMAIN TXT +short | grep spf1
dig SELECTOR._domainkey.DOMAIN TXT +short
dig _dmarc.DOMAIN TXT +short
dig -x SENDING_IP +short

WordPress sends through PHP mail() by default, from the web server’s IP, which is rarely in your SPF record. Route site mail through an authenticated SMTP service on port 587 using your domain, and set the From address to that domain.

Hard bounces with 5.7.26 or 5.7.515

• Open a failed or test message’s headers and read Authentication-Results.
• List every service that sends as DOMAIN (mail host, website, newsletter, invoicing, helpdesk).
• Make sure each one is in the single SPF record or signs with DKIM for DOMAIN.
• Start DMARC at p=none with reporting, read the reports, then tighten.

Everything to one provider is deferred with 4xx

grep 'RECIPIENT_DOMAIN' /var/log/mail.log | grep -E 'status=deferred' | tail -n 20

RECIPIENT_DOMAIN is the provider’s domain, such as gmail.com. Log location varies by system. Read the full reply text, check the IP against major blocklists, and check Google Postmaster Tools or Microsoft SNDS if you send in volume.

Gotchas

• The text matters more than the number. Providers reuse codes loosely. 5.7.1 can mean spam, blocklist or relay denied; only the message text tells you which.
• Microsoft reuses codes. Its 5.1.10 and 5.4.1 mean “recipient not found”, not their registry meanings.
• A bounce to you is not always yours. Backscatter (bounces for mail you never sent) comes from spammers forging your address. DMARC at enforcement reduces it.
• Forwarding breaks SPF. A forwarded message arrives from the forwarder’s IP. DKIM usually survives; that is why DKIM matters for DMARC.
• Mailing lists break DKIM. Lists that change the subject or footer invalidate signatures. ARC headers help receivers trust the list.
• The 10-lookup SPF limit. Each include, a, mx, ptr, exists and redirect costs a DNS lookup, including nested ones. Going over gives permerror.
• Credentials in your shell history. The Base64 AUTH string is your password in reversible form. Clear history after testing.
• Silence is not delivery. A 250 after DATA means the next server accepted it, not that it reached the inbox. Spam folder placement produces no bounce.