Skip to Main Content

Provider deliverability · Orange / Wanadoo (France)

Why is Orange blocking my emails?

Samuel Chenard

By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed September 15, 2026

Orange rejects mail that fails one of its published requirements and names the reason with a numeric code at the end of the error, such as OFR002_104. The most common are a missing DKIM signature (code 535), an SPF failure (519), a DMARC failure (515), a block-listed IP (99 to 103), and too many simultaneous connections (104).

The 30-second check

Orange is unusually direct about authentication. Its postmaster page says "SPF is required", "DKIM signing is required, message without signature may be rejected", and "DMARC configuration is required". For large senders it adds that all three "must all pass" and that the header From domain must match the authenticated domains. The free checker below reads SPF, DKIM and DMARC for the domain you send from in about thirty seconds.

Check your domain now

Enter your sending domain and the check runs instantly on the next page. Free, no signup.

Why Orange / Wanadoo is blocking your email

Likely causeWhat's happening
No DKIM signature, or one that does not match your From domainOrange lists DKIM as mandatory and documents the rejection as code 535: "DKIM signing is missing, message has been rejected". A message signed only by your sending platform's own domain is a second trap: the large-sender checklist says the header From domain "must match your authenticated domains", and code 988 tells rate-limited senders to "use your own DKIM domain to sign your messages".
SPF does not authorise the IP that actually sent the messageCode 519 is "The sending IP address is not authorized to send messages for your domain as defined in the sender's Domain name SPF configuration (DNS/TXT)", and 397/398 is a broken SPF record. A new sending service that was never added to the record, or a record that fails to parse, produces this on every message.
Your own DMARC policy told Orange to rejectCode 515 reads "DMARC authentication failed, message rejected as defined by your DMARC policy". Orange did what your record asked. It happens when the domain is at `p=quarantine` or `p=reject` while a legitimate sender still fails alignment, which is exactly the situation aggregate reports exist to surface before the policy is tightened.
The sending IP or domain is on a block listOrange checks Abusix (code 100), Spamhaus (101) and Cloudmark (102) for the IP, Abusix and Spamhaus for the sending domain (425), and keeps its own list (99 and 103, "Your sending IP has been blacklisted by Orange"). The public listings have self-service lookups; the Orange-internal one needs the contact form.
Too many connections, or too much per connectionOrange publishes hard numbers: "100 messages per connection, up to two simultaneous connections per sending IP address, and up to 100 recipients per message", with the note that "Different limits may applied based on your current reputation". Code 104 is too many simultaneous connections, 109 too many messages per connection. The example error Orange prints is `Trop de connexions, veuillez verifier votre configuration. Too many connections, slow down. OFR002_104`.
Missing reverse DNS, a bad HELO, or a dynamic IPCode 107 is a missing PTR record, and Orange adds that the PTR hostname must resolve back to the sending IP. The 20x codes are an invalid HELO/EHLO, which must be a fully qualified domain name that resolves. The sending IP "must be a static IP address" and the sender domain needs valid A or MX records (code 405).
Content Orange's filter classifies as spam, or a poor reputationCode 506 is "Your message has been blocked by Orange, suspected spam"; Orange says senders seeing many of these can request information through the Vade Secure Sendertool. Codes 988 to 990 are rate limits for a low IP or domain reputation, and 99x is a rate limit for "poor behavior". Orange's spam-report threshold is 0.6%, with a stated plan to move to 0.3%.
Dead addresses on the listCode 416, "User doesn't exist here", is the one Orange asks senders to act on themselves: "Please remove this email address from your distribution list, it does not exist". A French list that has not been cleaned concentrates its dead addresses at Orange and Wanadoo, and Orange reads that as a reputation signal.

Check the public signals before changing settings

Check your DMARC record gives you a fast public-DNS baseline. It does not replace the provider's private reputation or placement data, but it tells you whether an authentication problem is visible before you edit a sending platform.

Palisade DMARC checker result showing a published DMARC policy, report destination, and record tags for a non-sensitive test domain.
Source: Palisade, “DMARC checker”, checked 2026-07-29. First-party public tool result for a non-sensitive test domain; it validates what public DNS exposes.

How to fix it, step by step

  1. Check SPF, DKIM and DMARC on the domain in your From header

    Use the free checker above (or at /tools/dmarc). Orange requires all three and, for large senders, requires all three to pass with the From domain aligned to the authenticated domain. If DKIM is missing or signed by your platform's domain instead of yours, you have found the block before reading any code.

  2. Read the numeric code at the end of the Orange error

    Orange errors end in a code such as OFR002_104; the number after the underscore is the reason. Match it against the table on the Orange postmaster page. Codes 515, 519 and 535 are authentication; 99 to 103 and 425 are block lists; 104 and 109 are connection limits; 416 is a dead address.

  3. Sign with DKIM on your own domain and align it

    Publish the selector for every service that sends as your domain and confirm the d= tag is your From domain or a parent of it. Orange's rate-limit guidance for code 988 is explicit: sign with your own DKIM domain. Verify the published key at /tools/dkim before you retry.

  4. Add every sending IP to SPF and fix the record

    Code 519 means the IP that delivered the message is not in your SPF record; 397 and 398 mean the record itself is wrong. List every platform that sends as your domain, keep the record under the ten-lookup limit, and re-check it at /tools/spf. Orange notes DNS caches can take up to 24 hours to expire after a change.

  5. Clear the block lists Orange consults

    Look the IP up at Abusix, Spamhaus and Cloudmark, and the domain at Abusix and Spamhaus, using the lookup links Orange publishes beside codes 100 to 102 and 425. Run /tools/blocklist-checker for the wider picture. Codes 99 and 103 are Orange's own list and are cleared only through the contact form.

  6. Throttle to Orange's published limits

    Configure your MTA for at most two simultaneous connections per sending IP to Orange, no more than 100 messages per connection, and no more than 100 recipients per message. Orange says different limits may apply based on reputation, so a new IP should start below these numbers.

  7. Fix reverse DNS, HELO and TLS

    Set a PTR record whose hostname resolves back to the sending IP, use a resolving fully qualified domain name in HELO/EHLO, and offer TLS 1.2 or higher, which Orange strongly recommends because it no longer supports lower versions. Check the PTR and IP reputation at /tools/ip-reputation.

  8. Remove code 416 addresses and lower complaints

    Drop every address Orange has answered with "User doesn't exist here", add an RFC 8058 one-click unsubscribe, and keep spam reports well under Orange's 0.6% threshold, because Orange has said it will gradually adopt 0.3%. Large senders should also add the Feedback-ID header Orange asks for.

  9. Escalate through the Orange deliverability form with the exact code

    For codes 99, 103, 406, 506 and 536, and for rate limiting that persists after the fixes above, use the Orange contact form and select the option "Un problème d'envoi d'emails vers les adresses Orange ou Wanadoo (deliverability issue)". Include the full error line with its code, the sending IPs and the domain.

Related free tools: DKIM checker · SPF checker · IP reputation and reverse DNS · Blocklist checker

If you send in volume: Orange / Wanadoo's published rules

Orange publishes a separate checklist for large senders, which it defines as "more than 1000 messages per day". SPF, DKIM and DMARC "are mandatory and must all pass", and the header From domain "must match your authenticated domains". Senders should follow the M3AAWG best practices (Orange is a sponsor member), use the Feedback-ID header, make the display name in the header From "accurately represent the true sender, specifically the entity that holds the recipient's consent", and host a website behind the From domain that shows the company's address and identity, a reminder of how consent was obtained, and the legal notices. Spam reports "at 0.6% or above might trigger some protection mechanisms", and Orange states it "will gradually adopt a 0.3% spam-report rate" in line with the industry. Lists must not be bought, opt-in needs a verification email, and opt-out must be easy with RFC 8058 one-click unsubscribe. The Orange feedback loop is available only to authorised members of Signal Spam, the French public-private reporting scheme Orange sponsors. Checked 2026-09-15.

Check your standing with Orange / Wanadoo

Bounce codes you may be seeing

Blocks in this cluster surface as specific SMTP codes. Match yours below; the linked guides cover each code's verbatim provider messages and full fix.

The real root cause: unenforced authentication

Orange has written down what most providers only imply. SPF, DKIM and DMARC are all required, all three have to pass for anyone sending real volume, and the visible From domain has to be the domain that authenticated. Three of its rejection codes exist purely to tell you which of those checks failed. The codes are useful, but by the time you are reading them the damage is done at Orange, and the same weakness is costing you silently at every provider that does not print a reason. The fix is not to satisfy Orange; it is to make every sender of your domain authenticate and align, then publish a DMARC policy that turns the arrangement into enforcement. Aggregate reports show every service sending as your domain, including the ones nobody remembers authorising and the one whose DKIM key was never published. Authenticate each, then move from p=none to p=reject so that mail which cannot prove it is yours is refused everywhere, and code 515 becomes something that only ever happens to a forger.

DMARC software that does the work

Palisade's AI agent takes domains all the way to enforcement: hosted SPF, DKIM, DMARC, and MTA-STS records on paid plans, DMARC reports monitored continuously, and every policy step drafted for your approval on the way to p=reject. The Free plan covers one domain and up to 1,000 emails per month, and the agent names every problem it finds there; applying the agent's fixes needs a paid plan, and the full product is open for a 15-day trial.

Get startedBook a demo

1 domain free up to 1,000 emails/month

Fixing this across every client domain

A client with French customers hits Orange and Wanadoo constantly, and Orange's mandatory-DKIM rule turns a fleet of client domains into a fleet of separate signing and alignment projects. Palisade makes that one workflow: hosted and managed SPF, DKIM, DMARC, and MTA-STS records for every client domain, aggregate reports read so each unsigned or misaligned sending service is named rather than guessed at, and a path to p=reject with your team approving every change. Native ConnectWise, HaloPSA, and Autotask integrations put it in your PSA, pricing is per client domain with rates that improve as the portfolio grows, and your own MSP domain is a free NFR domain to prove the process on first.

Questions readers ask

Frequently asked questions

What does OFR002_104 from Orange mean?

It is Orange's error format: a bilingual message followed by an identifier whose last number is the reason code. Code 104 is "You are opening too many simultaneous connections". Orange recommends two simultaneous connections per sending IP and 100 messages per connection. Reduce concurrency in your MTA and the deferrals stop.

Does Orange require DKIM?

Orange requires DKIM. Its postmaster page states "DKIM signing is required, message without signature may be rejected", and code 535 is the rejection for a missing signature. For large senders, SPF, DKIM and DMARC "are mandatory and must all pass" and the header From domain must match the authenticated domain.

What is Orange error code 515?

Code 515 is "DMARC authentication failed, message rejected as defined by your DMARC policy". Orange applied the policy your own domain publishes. Find the sender that fails alignment in your aggregate reports, authenticate it, and only then keep the policy at quarantine or reject.

What is Orange error code 506?

Code 506 is "Your message has been blocked by Orange, suspected spam". Orange's guidance is to use the contact form with the deliverability option, and, for senders seeing many 506 rejections, to submit an information request through the Vade Secure Sendertool. Orange does not say which filter produced the classification.

How do I contact the Orange postmaster about a block?

Use the Orange contact form and select "Un problème d'envoi d'emails vers les adresses Orange ou Wanadoo (deliverability issue)". Orange asks senders to review the postmaster checklist and test their configuration first. Abuse reports go to abuse@orange.fr, which is a different queue from deliverability.

Does Orange have a feedback loop?

Yes, but only through Signal Spam. Orange says "Only SignalSpam authorized members may receive Orange Feedback Loop", so a sender wanting complaint data from Orange mailboxes has to join the French reporting scheme rather than enrol with Orange directly. Membership is a prerequisite, not a request you make to the Orange postmaster.

What spam complaint rate does Orange allow?

Orange says spam reports "at 0.6% or above might trigger some protection mechanisms" and that it "will gradually adopt a 0.3% spam-report rate" to align with industry standards. Treat 0.3% as the ceiling now rather than waiting for the change to land.

Are Orange and Wanadoo the same for senders?

Yes. Wanadoo addresses are served by Orange, the postmaster page covers "Orange/Wanadoo Email users" together, and the contact form option names both. One rule set, one error-code table and one escalation path apply to both domains. A rejection from a wanadoo.fr address carries the same OFR code as one from orange.fr.

Sources and last verified

Every Orange / Wanadoo fact on this page is drawn from that provider's own documentation, last checked 2026-09-15. Provider policies change; if a detail looks off, the linked source is authoritative.

Related guides

Why is GMX blocking my emails?Why is T-Online blocking my emails?Why is Yahoo blocking my emails?Why is Outlook blocking my emails?Why are my emails being blocked?Why is Zoho Mail blocking my emails?Why are my emails going to spam in Fastmail?Why are my emails going to spam in Proton Mail?Why is Proofpoint blocking my emails?Why is Mimecast blocking my emails?550 5.7.1554 5.7.1421 4.7.0550 5.1.1d=adkim / aspfselector
Email deliverability, fixed: the full guide