Bounce reference

SMTP error codes, explained and fixed

Match the code in your bounce message to the exact meaning, who's at fault, and the fix. No guessing from cryptic server-speak.

How to read a bounce message

Every bounce carries two codes. The three-digit reply code gives the verdict: 5xx is permanent (the message was refused and will not be retried), while 4xx is temporary (the message is deferred and the sending server keeps retrying, usually for a few days, before giving up).

The dotted enhanced status code (like 5.7.26) is the diagnosis. Its middle digit names the subject: .7. is security and policy (authentication, reputation, blocklists), while .1. is addressing and .2. is the mailbox itself. Find your code in the table below; each row links to the verbatim provider messages, the ranked causes, and the step-by-step fix.

Permanent failures (5xx)

The receiving server refused the message. It will not retry: fix the cause, then re-send.

CodeWhat it meansWho's at faultFix
550DKIM signature verification failedSenderCheck the domain's DKIM record →
550 5.1.1The email account that you tried to reach does not existEither sideCheck the recipient domain's MX records →
550 5.4.1Recipient address rejected, access deniedRecipientCheck the recipient domain's Microsoft 365 setup →
550 5.7.1Delivery not authorized, message refusedEither sideCheck the sending domain's DMARC, SPF, and DKIM first →
550 5.7.23The message failed SPF validationSenderRun your domain through the free SPF checker →
550 5.7.26Unauthenticated email is not acceptedSenderCheck the sending domain's DMARC, SPF, and DKIM in one pass →
550 5.7.509Access denied, sending domain does not pass DMARC verificationSenderRun the sending domain through the Microsoft compliance checker →
552 5.2.2The recipient's mailbox is fullRecipientRule out a routing problem before blaming quota →
553 5.7.1Sender address rejected, not owned by userSenderCheck who's authorized to send as your domain →
554 5.7.1Message refused or relay access deniedSenderCheck your sending IP against the major blocklists →

Temporary failures (4xx)

The message is deferred, not rejected. The sending server retries, but the underlying cause usually still needs fixing.

CodeWhat it meansWho's at faultFix
421 4.7.0Connection deferred or rate limited, try again laterSenderCheck the sending IP's reputation →
451 4.3.0Temporary server error, message deferredRecipientCheck the recipient domain's mail route first →

Bounce-code FAQ

The first digit is the verdict. A 5xx code is a permanent failure: the receiving server refused the message and it will not be retried; you have to fix the cause and re-send. A 4xx code is a temporary failure: the message is deferred and the sending server keeps retrying automatically, typically for 24–72 hours before it gives up and bounces.

That's the enhanced status code (RFC 3463). The first digit repeats the class (5 = permanent, 4 = temporary), the second names the subject area (7 = security or policy, 1 = addressing, 2 = mailbox), and the third pinpoints the specific condition. It's usually more precise than the three-digit reply code: 550 alone says 'refused', while 5.7.26 says 'refused because the mail was unauthenticated'.

Read the enhanced code and the text. Authentication and policy codes (5.7.x) almost always point at the sender: SPF, DKIM, DMARC, or reputation. Addressing and mailbox codes (5.1.1 nonexistent user, 5.2.2 mailbox full) point at the recipient. Temporary 4xx deferrals can be either: sender rate limits and reputation throttles, or a receiving server having a bad day.

Providers write their own human-readable text after the numeric codes, and some add proprietary sub-codes (Microsoft's 5.7.509, for example). The numbers are the standard part: match the reply code and enhanced status code first, then use the provider's wording to identify the exact variant.