Is 550 5.7.509 a hard bounce?

Yes. It is a permanent refusal, so the receiving server does not try again, and resending gets the same answer until SPF or DKIM passes and aligns with your From domain. The recipient's address is not the problem.

Why does only one Microsoft recipient bounce with 5.7.509?

Usually a forward. That address passes your mail on to another mailbox, the forwarding server is not in your SPF record, and any change to the message breaks DKIM. Signing DKIM with your own domain is the part you control; the forwarder can add ARC.

Should I set my DMARC policy to none to stop 550 5.7.509?

No. It stops the bounces and the protection with them: receivers then deliver mail that fails DMARC, including mail that spoofs your domain. Make the sending service pass and align instead, then keep the reject policy.

Fix 550 5.7.509: access denied by DMARC

550 5.7.509DMARC failed and the policy is rejectMicrosoft 365

What it means: The domain in the From address did not pass DMARC, and its DMARC policy says reject.
Why it happens: A missing or wrong DMARC, SPF or DKIM record, SPF or DKIM that do not align with the From domain, no DKIM signature, or forwarding that broke SPF or DKIM.
The fix: Read the reasons in the NDR, then add, correct or align the records. If a DMARC report service reads your reports, ask it. The NDR includes the failed message's headers.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

450 4.2.1Recipient is getting mail too fastGmail

What it means: The recipient is receiving email faster than Gmail lets one mailbox take it, so Gmail put your message off.
Why it happens: The recipient's mailbox, not your setup, hit Gmail's receiving rate.
The fix: Nothing to change. Your server tries again; if the recipient can take mail then, it is delivered.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

452 4.2.2Recipient's inbox is out of storageGmail

What it means: The recipient's Google storage is full, so the message waits.
Why it happens: The recipient has used up their Drive, Gmail and Photos storage.
The fix: Tell the recipient another way, or wait. It is theirs to fix.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

421 4.7.0Rate limited or blocked for low reputation or contentGmail

What it means: Gmail held back your mail with a temporary code. A very low IP reputation gets the IP rate limited; a very low domain reputation, or the content or links in the message, gets the message blocked.
Why it happens: Gmail's spam checks judged the IP, the domain or the content suspicious.
The fix: Send less, and only to people who expect your mail. Check the links and content. Google points to 'Why has Gmail blocked my messages?'.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

421 4.7.0Sending IP has no PTR record (rate limited)Gmail

What it means: The sending IP address has no PTR (reverse DNS) record, or that record does not point back to the IP, so Gmail rate limited it.
Why it happens: Reverse DNS for the sending IP is missing or does not match.
The fix: Ask whoever runs the sending server to set a PTR record whose name resolves back to the same IP.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

421 4.7.0Recipient's domain requires TLSGmail

What it means: The recipient's domain only takes mail over an encrypted (TLS) connection, and yours was not.
Why it happens: Your sending server did not use TLS.
The fix: Turn on TLS for outgoing mail on the sending server.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

451 4.7.26DMARC could not be checked (DNS failure)Gmail

What it means: Your domain's DMARC policy asks Gmail to refuse unauthenticated mail, and a temporary DNS failure kept Gmail from checking.
Why it happens: A DNS lookup for SPF, DKIM or DMARC failed for a moment.
The fix: Usually passes on retry. If it repeats, check that your DNS host answers reliably.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

421 4.7.26Unauthenticated mail (rate limited)Gmail

What it means: Neither SPF nor DKIM passed, so Gmail rate limited the message. Gmail requires every sender to pass one of them.
Why it happens: The sending domain has no SPF or DKIM set up for the server that sent this, or they fail.
The fix: Set up SPF and DKIM for the sending domain. Google points to its Email sender guidelines for this one.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

421 4.7.27SPF did not pass (rate limited)Gmail

What it means: SPF did not pass for this message. Gmail requires bulk senders to pass SPF.
Why it happens: The sending IP is not in the domain's SPF record, or the record is broken.
The fix: Add the sending service to your SPF record. Google points to 'Set up SPF'.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

421 4.7.28Unusual rate of email (rate limited)Gmail

What it means: Gmail saw an unusual rate of email, or of unsolicited email, from your IP, IP range, DKIM domain, SPF domain or a link domain, and slowed it down.
Why it happens: Volume jumped, or many recipients marked the mail as spam.
The fix: Slow down and send only to people who expect your mail. Google points to its bulk sender guidelines.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

421 4.7.29No TLS (rate limited)Gmail

What it means: The message was not sent over TLS. Gmail requires bulk senders to use TLS.
Why it happens: The sending server connected without encryption.
The fix: Turn on TLS for outgoing mail.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

421 4.7.30DKIM did not pass (rate limited)Gmail

What it means: DKIM did not pass for this message. Gmail requires bulk senders to sign with DKIM.
Why it happens: The message was not signed, or the signature did not verify.
The fix: Turn on DKIM signing for the sending domain. Google points to 'Set up DKIM'.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

421 4.7.32From domain not aligned (rate limited)Gmail

What it means: The domain in the From: header does not match the domain that passed SPF or DKIM. Google lists the same text under 421 5.7.32 as a block.
Why it happens: You send from one domain while SPF or DKIM pass for another (often the sending service's own domain).
The fix: Sign with DKIM for your From domain, or use a return-path on your own domain, so one of them aligns. Google points to 'DMARC alignment'.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

421 4.7.40No DMARC record (rate limited)Gmail

What it means: The sending domain has no DMARC record, or the record sets no policy. Gmail requires bulk senders to publish one.
Why it happens: No _dmarc TXT record on the From domain, or it lacks p=.
The fix: Publish a DMARC record for the domain. Google points to 'Set up DMARC'.
Bounce: Soft bounce. Your server retries on its own

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.1.1Address does not existGmail

What it means: The Gmail or Google Workspace account you wrote to does not exist.
Why it happens: A typo or stray space in the address, or the account was never there or was removed.
The fix: Check the address for typos or spaces. If it is right, the mailbox is gone: stop sending to it.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

553 5.1.2Recipient domain not foundGmail

What it means: Gmail could not find the domain after the @.
Why it happens: The domain is misspelled, or punctuation or a space follows the address.
The fix: Check the spelling of the domain and remove anything after the address.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

553 5.1.3Recipient address is not validGmail

What it means: The recipient address is not a valid address under the SMTP standard (RFC 5321).
Why it happens: The address is malformed.
The fix: Fix the address format.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.2.1Account is inactiveGmail

What it means: The account you wrote to is inactive.
Why it happens: The account was disabled or left unused.
The fix: Stop sending to it, or reach the person another way.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

552 5.2.2Inbox full and inactiveGmail

What it means: The recipient's inbox is out of storage and the account is inactive.
Why it happens: The recipient's storage is full and they are not using the account.
The fix: Reach the person another way. It is theirs to fix.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

552 5.3.4Message or headers too bigGmail

What it means: The message, its attachments or its headers exceeded Google's size limits.
Why it happens: Too large a message, too many attachments, or headers that are too long.
The fix: Send a smaller message, or share large files as links.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.4.5Daily sending limit exceededGmail

What it means: The sending Gmail or Workspace account, or its SMTP relay, passed its daily sending limit.
Why it happens: Too many messages or recipients from one account in a day.
The fix: Wait for the limit to reset and send less per account. Google points to 'Gmail sending limits'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

554 5.6.0Malformed messageGmail

What it means: Gmail did not accept the message because it is malformed.
Why it happens: The message breaks the message format standard (RFC 5322).
The fix: Fix how the sending software builds messages. Google points to its Email sender guidelines for this one.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

552 5.7.0Blocked for a security issue in the contentGmail

What it means: Gmail blocked the message because its content or an attachment may be a security risk.
Why it happens: An attachment type Gmail blocks, or content Gmail treats as dangerous.
The fix: Remove the attachment or send it another way. Google points to 'File types blocked in Gmail'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.0Workspace SMTP relay deniedGmail

What it means: Google Workspace's SMTP relay refused the message: the sending IP or domain is not registered in the Workspace relay settings, or the account is suspended.
Why it happens: A device or app is relaying through Google from an IP or domain the Workspace admin has not allowed.
The fix: In the Admin console, add the device's IP address to the SMTP relay settings. Google points to 'SMTP relay service error messages'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Blocked by the recipient's policyGmail

What it means: The user or domain you sent to (or from) has a policy that does not allow this email.
Why it happens: A rule at the recipient's domain or at yours blocks this sender, recipient or content.
The fix: Ask the domain's administrator. Google points to 'Sorry, a policy is in place that prevents your message from being sent'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Blocked by a custom admin rule (gcdp)Gmail

What it means: A rule that the recipient's Google Workspace administrator created blocked the message. Gmail marks these errors with 'gcdp'.
Why it happens: The recipient organisation filters this sender, domain or content on purpose.
The fix: Ask the recipient to have their administrator allow your mail.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Likely unsolicited emailGmail

What it means: Gmail blocked the message as likely spam.
Why it happens: The content, the sending pattern or the recipients' reactions look like unsolicited mail.
The fix: Send only to people who expect your mail and make it easy to unsubscribe. Google points to 'Why has Gmail blocked my messages?'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Very low IP reputationGmail

What it means: Gmail blocked the message because the sending IP address has a very low reputation.
Why it happens: Mail from that IP drew spam reports or looked like spam.
The fix: Send from an IP with a clean history, slow down and clean the list. Google points to 'Why has Gmail blocked my messages?'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Very low domain reputationGmail

What it means: Gmail blocked the message because the sending domain has a very low reputation.
Why it happens: Mail from that domain drew spam reports or looked like spam.
The fix: Check SPF, DKIM and DMARC, send less, only to people who expect it. Google points to 'Why has Gmail blocked my messages?'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Headers break the message standardGmail

What it means: Gmail refused the message because its headers break RFC 5322: a missing or doubled From:, no valid Message-ID:, duplicate or malformed headers, or encoded words where they are not allowed.
Why it happens: The sending software builds the message headers wrongly.
The fix: Fix the headers in the sending software. Google points to its Email sender guidelines for this one.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Rate limitedGmail

What it means: Gmail refused the message because of a sending or receiving rate limit, or the Workspace SMTP relay's daily limit.
Why it happens: Too much mail in too short a time.
The fix: Send less and spread it out. Google points to 'Limits for sending & getting email'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1IP not allowed to send directlyGmail

What it means: The IP address you send from may not deliver straight to Gmail's servers.
Why it happens: Usually a home or dynamic IP address sending directly instead of through a mail provider.
The fix: Send through your provider's SMTP relay instead of directly.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1IPv6 sending rules not metGmail

What it means: Mail sent over IPv6 did not meet Gmail's PTR record and authentication rules.
Why it happens: The IPv6 address lacks a PTR record, or the message did not authenticate.
The fix: Set a PTR record for the IPv6 address and set up SPF and DKIM, or send over IPv4. Google points to its Email sender guidelines for this one.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Invalid credentials for Workspace relayGmail

What it means: The IP address registered in the Workspace SMTP relay does not match the domain the mail is sent from.
Why it happens: The relay setting expects another domain, or the envelope sender is empty.
The fix: Use SMTP AUTH on the sending server, or present one of your domains in HELO or EHLO. Google points to 'SMTP relay service error messages'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.24Suspicious entries in the SPF recordGmail

What it means: The sending domain's SPF record has one or more entries Gmail treats as suspicious.
Why it happens: The SPF record includes something it should not.
The fix: Review and tidy the SPF record. Google points to its Email sender guidelines for this one.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.25Sending IP has no PTR recordGmail

What it means: The sending IP address has no PTR record, or its forward DNS does not point back to the IP. Gmail requires a PTR record.
Why it happens: Reverse DNS for the sending IP is missing or does not match.
The fix: Ask whoever runs the sending server to set a matching PTR record.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.26Unauthenticated emailGmail

What it means: Gmail blocked the message because neither SPF nor DKIM passed. Gmail requires every sender to pass at least one.
Why it happens: The sending domain has no SPF or DKIM set up for the server or service that sent this, or both fail.
The fix: Add the sending service to your SPF record and turn on DKIM signing for your domain, then send again. Google points to its Email sender guidelines for this one.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.26SPF hard failGmail

What it means: The envelope sender's domain has an SPF record ending in -all, and the sending IP failed it.
Why it happens: You send from a server or service your SPF record does not list.
The fix: Add the sending service to the SPF record, or send through a server it lists.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.26Blocked by the sender domain's DMARC policyGmail

What it means: The From domain's DMARC policy tells receivers to refuse mail that does not authenticate, and this message did not.
Why it happens: SPF and DKIM did not pass for the From domain, or did not align with it.
The fix: Make SPF or DKIM pass and align with the From domain for every service that sends as you. If it was not you, someone spoofed your domain and the block worked.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.27SPF did not pass (bulk sender)Gmail

What it means: Gmail blocked the message because SPF did not pass. Gmail requires bulk senders to pass SPF.
Why it happens: The sending IP is not in the domain's SPF record.
The fix: Add the sending service to the SPF record. Google points to 'Set up SPF'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.28Unusual rate of unsolicited emailGmail

What it means: Gmail blocked mail from your IP address because it saw an unusual rate of unsolicited email from it.
Why it happens: Volume spiked, or many recipients marked the mail as spam.
The fix: Stop, find what changed, and send only to people who expect your mail. Google points to its bulk sender guidelines.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.29No TLS (bulk sender)Gmail

What it means: Gmail blocked the message because it was not sent over TLS. Gmail requires bulk senders to use TLS.
Why it happens: The sending server connected without encryption.
The fix: Turn on TLS for outgoing mail.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.30DKIM did not pass (bulk sender)Gmail

What it means: Gmail blocked the message because DKIM did not pass. Gmail requires bulk senders to sign with DKIM.
Why it happens: The message was not signed, or the signature did not verify.
The fix: Turn on DKIM signing for the sending domain. Google points to 'Set up DKIM'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.40No DMARC record (bulk sender)Gmail

What it means: Gmail blocked the message because the sending domain has no DMARC record, or the record sets no policy.
Why it happens: No _dmarc TXT record on the From domain, or it lacks p=.
The fix: Publish a DMARC record for the domain. Google points to 'Set up DMARC'.
Bounce: Hard bounce. No automatic retry

Source: knowledge.workspace.google.com (opens in a new tab). Checked Nov 9, 2026.

4.4.7Message expired in the queueMicrosoft 365

What it means: Exchange Online kept trying to deliver or relay the message and the message expired first.
Why it happens: Usually a problem at the receiving server, a header limit at the remote server, or a protocol timeout.
The fix: Check the recipient address and whether the receiving server takes mail. Fewer recipients per message can help.
Bounce: Soft bounce. Your server retries on its own

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

4.4.316Connection refused by the remote serverMicrosoft 365

What it means: Microsoft 365 could not connect to the receiving server outside Microsoft.
Why it happens: A network problem at the external server's location.
The fix: The receiving side fixes it. The NDR includes the IP address of the server that failed.
Bounce: Soft bounce. Your server retries on its own

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

4.5.3Too many recipientsMicrosoft 365

What it means: The message has more than 200 envelope recipients at the same domain.
Why it happens: Too many RCPT TO addresses for one domain in one message.
The fix: The sending server splits the recipients into smaller batches and sends again.
Bounce: Soft bounce. Your server retries on its own

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

4.7.26IPv6 mail must pass SPF or DKIMMicrosoft 365

What it means: Mail sent to Microsoft over IPv6 must pass SPF or DKIM, and this message did not.
Why it happens: The message was not signed and SPF did not pass.
The fix: Set up SPF and DKIM for the sending domain.
Bounce: Soft bounce. Your server retries on its own

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

451 4.7.500-699Temporarily restricted (IP throttling)Microsoft 365

What it means: Microsoft saw suspicious activity and temporarily restricted sending. The ASxxx codes are IP throttling: the sending IP suddenly sent far more than before.
Why it happens: A new sender, or a jump in volume from the sending IP.
The fix: Usually lifts as your sending history builds over a few days. Admins relaying through Microsoft 365 set up a connector.
Bounce: Soft bounce. Your server retries on its own

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

4.7.850-899IP temporarily restrictedMicrosoft 365

What it means: Microsoft saw suspicious activity on the sending IP and restricted it while it looks further.
Why it happens: Activity from the IP looked suspicious.
The fix: If the mail is legitimate, the restriction lifts shortly.
Bounce: Soft bounce. Your server retries on its own

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.0.350Generic error from the recipient's organisationMicrosoft 365

What it means: A catch-all code for many nonspecific errors from the recipient's mail system. 'x-dg-ref header is too long' points to Rich Text messages; 'AS345' points to nested attachments.
Why it happens: Depends on the text after the code.
The fix: Read the text after the code. Send as HTML or plain text, or without nested attachments, when the text names those.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.1.0Address rejected (sender denied)Microsoft 365

What it means: The receiving server will not accept messages from you, or for that recipient. The NDR often says 'Address Rejected' or 'Recipient address rejected: SPF Permanent Error'.
Why it happens: You may be on the recipient's block list, your Auto-Complete entry for the recipient may be stale, or your domain's SPF record may not list all the places your mail comes from.
The fix: Check the address and send again. Clear the recipient's Auto-Complete entry. Ask the recipient whether they block you. Admins: complete the SPF record.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.1.1Bad destination mailbox addressMicrosoft 365

What it means: The recipient's address does not exist at the receiving system.
Why it happens: A mistyped address, an address that was valid once and was changed or removed, or a stale Outlook Auto-Complete entry.
The fix: Check the address and send a new message. Remove the recipient from Auto-Complete. If the address is right, the mailbox is gone: stop sending to it.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.1.8Bad outbound senderMicrosoft 365

What it means: The sending account was blocked for sending too much spam.
Why it happens: Usually the account was compromised by phishing or malware.
The fix: Secure the account (reset the password, check rules), then an admin asks for the block to be lifted.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.1.10Recipient not foundMicrosoft 365

What it means: The address lookup did not find the recipient. The address does not exist or could not be found.
Why it happens: A wrong or old address, a recipient forwarding rule pointing at a bad address, or backscatter: a spammer forged your address and you got the bounce.
The fix: Check the address and send again. If the bounce is for mail you never sent, it is backscatter and you can ignore it. If the address is right, stop sending to it.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.1.20Several From addresses and no SenderMicrosoft 365

What it means: The message has more than one address in From: and none in Sender:.
Why it happens: The sending software set several From addresses.
The fix: Use one From address, or add a Sender: address.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.1.90Daily recipient limit reachedMicrosoft 365

What it means: The sender reached the daily limit for message recipients.
Why it happens: Too many recipients in a day. It can also mean the account is compromised and sending spam.
The fix: Wait for the limit to reset and send less. Check the account for compromise.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

554 5.2.2Submission quota exceededMicrosoft 365

What it means: The sender passed the recipient rate limit or the message rate limit.
Why it happens: Too many messages or recipients from one mailbox. It can also mean the account is compromised.
The fix: Wait and send less from this mailbox. Check the account for compromise.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.2.121Too many messages to one recipient per hourMicrosoft 365

What it means: The sender passed the number of messages one sender may send to one Exchange Online recipient in an hour.
Why it happens: An automated mailer or one sender sent many messages to the same person.
The fix: Try again later and send fewer messages per hour to that recipient.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.2.122Recipient's hourly receive limit reachedMicrosoft 365

What it means: The recipient passed the number of messages they can receive per hour from all senders.
Why it happens: A mail storm toward that mailbox.
The fix: Try again later.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.4.1Relay access deniedMicrosoft 365

What it means: The server that answered does not accept mail for the recipient's domain.
Why it happens: A mail server or DNS (MX) misconfiguration on the recipient's side.
The fix: The recipient's admin checks the domain's MX record and accepted domains.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.4.1Recipient address rejected: access deniedMicrosoft 365

What it means: The recipient's address does not exist. The recipient's organisation rejects unknown addresses at the edge.
Why it happens: The address is wrong or gone.
The fix: Check the address. If it is right, stop sending to it.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

554 5.4.14Routing loop detectedMicrosoft 365

What it means: Delivery set off a loop of messages, and Exchange stopped it after 20 rounds (5.4.6 on servers on premises).
Why it happens: A configuration error, often automatic forwarding, at the sending or receiving server.
The fix: Admins check forwarding rules and mailbox rules on both sides.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.5.0Outlook.com or Hotmail address not foundMicrosoft 365

What it means: The recipient's @hotmail.com or @outlook.com address was not found.
Why it happens: The address does not exist.
The fix: Check the address. If it is right, stop sending to it.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.6.11Invalid characters (bare line feeds)Microsoft 365

What it means: Your email program put bare line feed characters in the message.
Why it happens: The sending software ends lines incorrectly.
The fix: Update or fix the sending software.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Delivery not authorizedMicrosoft 365

What it means: You are not allowed to send to this recipient. Often a group that only takes mail from its members or approved senders, or a mail flow rule that blocks the message.
Why it happens: A restriction on the recipient, the group, or a transport rule.
The fix: Ask the recipient or the group owner for permission. If the recipient is outside your company, ask them to tell their email admin.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Unable to relayMicrosoft 365

What it means: The server you sent to is not the final destination for that recipient and will not pass the message on for you.
Why it happens: An MX record points at a server that does not accept that domain, or the sending client lacks permission to relay.
The fix: The recipient's admin fixes the MX record or accepted domains; a client that should relay gets permission.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

530 5.7.1Client was not authenticatedMicrosoft 365

What it means: The receiving server requires authentication before it takes mail, and the sending system did not authenticate.
Why it happens: The receiving server does not take anonymous mail from the internet.
The fix: The sending system's admin sets it up to authenticate with the receiving server.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Sending IP is on Microsoft's block listMicrosoft 365

What it means: The sending IP address is on Microsoft's block list.
Why it happens: Mail from that IP looked like spam to Microsoft.
The fix: Use Microsoft's delist portal, or forward the NDR to the address it gives.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.12Recipient takes mail only from inside its organisationMicrosoft 365

What it means: The recipient address rejects messages from outside its organisation.
Why it happens: A setting on the recipient's side.
The fix: Only the recipient's email admin can change it.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.23SPF violationMicrosoft 365

What it means: The receiving system checks SPF and your SPF setup failed it.
Why it happens: The sending server is not in your SPF record, or the record is broken.
The fix: Fix the SPF record so it lists every server and service that sends as your domain.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.25IPv6 sender needs reverse DNSMicrosoft 365

What it means: The sending IPv6 address needs a reverse DNS record to send over IPv6.
Why it happens: No PTR record for the IPv6 address.
The fix: Add a reverse DNS record for the IPv6 address, or send over IPv4.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.57Device or app not authenticated to relayMicrosoft 365

What it means: An app or device sending through smtp.office365.com did not authenticate.
Why it happens: The app or device's SMTP settings are wrong.
The fix: Fix the app or device's SMTP sign-in settings.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.64TenantAttribution; relay access deniedMicrosoft 365

What it means: Mail from the on-premises environment no longer matches the inbound connector's settings.
Why it happens: Something changed on premises after the connector was set up.
The fix: The admin updates the inbound connector.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.124Not on the group's allowed senders listMicrosoft 365

What it means: The group only takes mail from its allowed senders, and you are not on that list.
Why it happens: A setting on the group.
The fix: Ask the group owner to add you.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.133Group takes mail only from insideMicrosoft 365

What it means: The group rejects messages from outside its organisation.
Why it happens: A setting on the group.
The fix: The recipient's admin or group owner can change it.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.134Mailbox takes mail only from insideMicrosoft 365

What it means: The mailbox rejects messages from outside its organisation.
Why it happens: A setting on the mailbox.
The fix: Only the recipient's email admin can change it.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.136Mail user takes mail only from insideMicrosoft 365

What it means: The recipient is a mail user set to reject messages from outside its organisation.
Why it happens: A setting on the recipient.
The fix: Only the recipient's email admin can change it.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.232Trial tenant's daily external recipient limitMicrosoft 365

What it means: Your trial tenant passed its daily limit for sending to external recipients.
Why it happens: Too many external recipients in a rolling 24 hours for a trial tenant.
The fix: Wait until the last 24 hours fall below the limit.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.233Tenant's daily external recipient limitMicrosoft 365

What it means: Your organisation (tenant) passed its daily limit for sending to external recipients, the tenant external recipient rate limit.
Why it happens: Too many external recipients across the whole tenant in a rolling 24 hours.
The fix: Wait. Sending to external recipients works again once the count for the last 24 hours falls below the limit. Spread large sends out.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.236onmicrosoft.com domain sending limitMicrosoft 365

What it means: Your tenant sent to more than 100 external recipients in 24 hours from its onmicrosoft.com domain.
Why it happens: onmicrosoft.com domains are for testing only.
The fix: Add a custom domain and send from it.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.350Remote server rejected it as spamMicrosoft 365

What it means: Microsoft 365 is passing on another server's refusal: the recipient's server (or its filter) judged the message to be spam. The reply after '->' is that server's own code and reason.
Why it happens: Depends on the remote server's reason, often the sending domain's reputation or authentication, or the links in the message.
The fix: Decode the code after '->': that is the real reason. Check SPF, DKIM and DMARC for your domain and the links in the message.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.367Remote server: not permitted to relayMicrosoft 365

What it means: A forwarded or relayed message from Microsoft 365 was refused by the next server, usually a non-Microsoft gateway, with 'not permitted to relay'.
Why it happens: SPF failed or soft-failed when the message entered Microsoft 365, so Microsoft sent it from its relay pool, which other servers do not treat as Microsoft and often refuse.
The fix: Make SPF pass on the way in (use Enhanced Filtering for Connectors when your MX points elsewhere), add domains you control as accepted domains, and avoid long forwarding chains.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.501Spam abuse detectedMicrosoft 365

What it means: The sending account was banned for spam.
Why it happens: Microsoft detected spam from the account.
The fix: Fix the account (reset credentials), then contact Microsoft Support to restore sending.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.502Banned senderMicrosoft 365

What it means: The sending account was banned for spam.
Why it happens: Microsoft detected spam from the account.
The fix: Fix the account and reset its credentials, then contact support to restore sending.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.503Banned senderMicrosoft 365

What it means: The sending account was banned for spam.
Why it happens: Microsoft detected spam from the account.
The fix: Fix the account and reset its credentials, then contact support to restore sending.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.504Recipient address rejectedMicrosoft 365

What it means: The recipient address is not valid.
Why it happens: The address is wrong or gone.
The fix: Check the address. If it is right, stop sending to it.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.505Banned recipientMicrosoft 365

What it means: The recipient is not valid.
Why it happens: The address is banned.
The fix: Stop sending to it. Contact support if you think this is wrong.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.506Bad HELOMicrosoft 365

What it means: Your server introduced itself (HELO) as the server it was connecting to, not by its own name.
Why it happens: A misconfigured server, or spam software.
The fix: Set the sending server's HELO name to its own fully qualified domain name.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.507Rejected by recipientMicrosoft 365

What it means: The recipient's organisation blocked the IP you send from.
Why it happens: The recipient chose to block your sending IP.
The fix: Contact the recipient.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.508IPv6 range over its limitMicrosoft 365

What it means: Your IPv6 range sent too many messages in too short a time.
Why it happens: A burst of mail from the range.
The fix: Send more slowly.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.510Recipient does not take mail over IPv6Microsoft 365

What it means: You sent over IPv6 and the recipient does not accept mail over IPv6.
Why it happens: The recipient's setting.
The fix: Send over IPv4.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.511Sending IP bannedMicrosoft 365

What it means: The IP you send from was banned.
Why it happens: Mail from the IP looked like spam to Microsoft.
The fix: Email delist@microsoft.com with the full NDR code and IP address, or use the delist portal.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.512No valid From addressMicrosoft 365

What it means: The message has no valid address in the From header.
Why it happens: The From header is missing or formatted wrongly (the address goes in angle brackets).
The fix: Fix the From header in the sending software.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.513Blocked by the recipient's own block listMicrosoft 365

What it means: The recipient's domain put your sending IP on its custom block list.
Why it happens: The recipient chose to block the IP.
The fix: Contact the recipient and ask them to remove it.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.520External forwarding not allowedMicrosoft 365

What it means: Exchange Online saw an automatically forwarded message and the organisation's outbound spam policy blocks forwarding outside.
Why it happens: A forwarding rule sends mail outside the organisation.
The fix: The admin allows external forwarding for that mailbox, or the user removes the rule.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.606-649Sending IP bannedMicrosoft 365

What it means: The IP you send from was banned.
Why it happens: The IP's reputation is poor, from compromise or malicious traffic.
The fix: Follow deliverability best practice, then ask for removal in the delist portal.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.703Blocked by your Tenant Allow/Block ListMicrosoft 365

What it means: Someone in your organisation sent to an address or domain your organisation blocks in its Tenant Allow/Block List. The whole message is blocked for every recipient.
Why it happens: A block entry in your own tenant matches one recipient.
The fix: Only an email admin in your organisation can change the Tenant Allow/Block List. Or send again without the blocked recipient.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.705Tenant over its thresholdMicrosoft 365

What it means: Your organisation sent too much spam or bulk mail, so Exchange Online blocked its outgoing mail.
Why it happens: Often a compromised server or admin account. Also, rarely, while an expired subscription renews.
The fix: Fix the cause, then contact Microsoft Support to remove the block.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.708Traffic not accepted from this IPMicrosoft 365

What it means: You sent from an IP address with a low reputation, most often on a new or trial tenant.
Why it happens: The sending IP's reputation.
The fix: On a trial, contact Microsoft Support for an IP exception until licences are assigned.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.750Sending from unregistered domainsMicrosoft 365

What it means: Many messages came from a domain that is not an accepted domain in your tenant.
Why it happens: Sending as a domain you have not added to Microsoft 365, or a misconfigured connector.
The fix: Add and validate every domain you send from, check connectors and accounts, then contact support to lift the block.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab), learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.800Sender domain bannedMicrosoft 365

What it means: The EHLO, envelope or header sender domain was banned for spam.
Why it happens: Microsoft detected spam from the domain.
The fix: Contact Microsoft support to restore the domain's sending.
Bounce: Hard bounce. No automatic retry

Source: learn.microsoft.com (opens in a new tab). Checked Nov 9, 2026.

421 or 451Temporary error (deferred)Yahoo

What it means: Yahoo put the message off for now.
Why it happens: Unusual traffic from your IP, content that looks like spam, complaints from Yahoo users, busy servers, a name server that did not answer, or authentication that could not be checked.
The fix: Your server may retry later. Review Yahoo's Sender Requirements & Recommendations if it repeats.
Bounce: Soft bounce. Your server retries on its own

Source: senders.yahooinc.com (opens in a new tab). Checked Nov 9, 2026.

553 or 554Permanent errorYahoo

What it means: Yahoo refused the message for good.
Why it happens: An invalid address, failed DMARC or DKIM checks, content Yahoo will not take, other suspicious behaviour, or an IP listed by Spamhaus.
The fix: Do not retry. Remove addresses that hard bounce, and review Yahoo's Sender Requirements & Recommendations.
Bounce: Hard bounce. No automatic retry

Source: senders.yahooinc.com (opens in a new tab). Checked Nov 9, 2026.

554Recipient does not existYahoo

What it means: The Yahoo account you wrote to does not exist.
Why it happens: A wrong address, or the account was closed.
The fix: Do not retry. Remove the address from your list.
Bounce: Hard bounce. No automatic retry

Source: senders.yahooinc.com (opens in a new tab). Checked Nov 9, 2026.

553 or 554Authentication failureYahoo

What it means: The message failed authentication checks. Yahoo requires every sender to pass SPF or DKIM, and bulk senders to pass both and publish DMARC.
Why it happens: Missing or failing SPF, DKIM or DMARC, a DKIM signature that fails the signing domain's policy, or forwarding.
The fix: Set up SPF, DKIM and DMARC. Mailing lists put the list address in From:. Forwarders can add ARC.
Bounce: Hard bounce. No automatic retry

Source: senders.yahooinc.com (opens in a new tab). Checked Nov 9, 2026.

554Content block (PH errors)Yahoo

What it means: Yahoo refused the message for its content.
Why it happens: Viruses, phishing, ransomware, other malware, or links to them.
The fix: Check outgoing mail for harmful content and make sure no one is abusing your server.
Bounce: Hard bounce. No automatic retry

Source: senders.yahooinc.com (opens in a new tab). Checked Nov 9, 2026.

421Temporarily deferred (TS errors)Yahoo

What it means: Yahoo deferred the message. Your server may try again later.
Why it happens: Complaints from Yahoo users, content that looks like spam, a poor IP reputation, or unusual traffic.
The fix: Review outgoing mail. If it lasts, send Yahoo a Sender Support Request with the error codes.
Bounce: Soft bounce. Your server retries on its own

Source: senders.yahooinc.com (opens in a new tab). Checked Nov 9, 2026.

554 5.7.1Relay access deniedAny server

What it means: The server you handed the message to is not the destination for the recipient's domain, and it does not know you as a client that may pass mail on. Postfix servers answer this with 554 by default.
Why it happens: You are sending through a server that has not authenticated you (no SMTP sign-in) and does not trust your network, or the recipient domain's MX points at a server that does not accept that domain.
The fix: Sign in to the outgoing server (SMTP AUTH) in your mail app or sending tool, or send through your own provider's server. Server admins: allow your clients (authenticated users or trusted networks) to relay.
Bounce: Hard bounce. No automatic retry

Source: postfix.org (opens in a new tab), postfix.org (opens in a new tab). Checked Nov 9, 2026.

550 5.7.0Message size violationAny server

What it means: A server on the way, or the receiving server, refused the message because it is bigger than its size limit allows.
Why it happens: A large attachment, or a size limit set on that server.
The fix: Send a smaller message, or share the file as a link. If the limit is on your own server, raise it.
Bounce: Hard bounce. No automatic retry

Source: support.kerioconnect.gfi.com (opens in a new tab), knowledge.broadcom.com (opens in a new tab). Checked Nov 9, 2026.

550 5.7.1Rejected per DMARC policyAny server

What it means: The receiving server refused the message because it failed DMARC for the From domain, and that domain's policy asks receivers to reject such mail. The DMARC standard suggests receivers say 'DMARC' in the reply, for example '550 5.7.1 Email rejected per DMARC policy for example.com'.
Why it happens: Neither SPF nor DKIM passed in alignment with the From domain. Common causes: a sending service that is not set up for your domain, or forwarding.
The fix: Make SPF or DKIM pass and align with your From domain for every service that sends as you. If the mail was not yours, someone spoofed your domain and the policy worked.
Bounce: Hard bounce. No automatic retry

Source: rfc-editor.org (opens in a new tab). Checked Nov 10, 2026.

421<domain> Service not available, closing transmission channel (This may be a reply to any command if the service knows it must shut down)The standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

450Requested mail action not taken: mailbox unavailable (e.g., mailbox busy or temporarily blocked for policy reasons)The standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

451Requested action aborted: local error in processingThe standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

452Requested action not taken: insufficient system storageThe standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

455Server unable to accommodate parametersThe standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

500Syntax error, command unrecognized (This may include errors such as command line too long)The standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

501Syntax error in parameters or argumentsThe standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

502Command not implemented (see Section 4.2.4)The standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

503Bad sequence of commandsThe standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

504Command parameter not implementedThe standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

550Requested action not taken: mailbox unavailable (e.g., mailbox not found, no access, or command rejected for policy reasons)The standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

551User not local; please try <forward-path> (See Section 3.4)The standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

552Requested mail action aborted: exceeded storage allocationThe standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

553Requested action not taken: mailbox name not allowed (e.g., mailbox syntax incorrect)The standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

554Transaction failed (Or, in the case of a connection-opening response, "No SMTP service here")The standard

Source: rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

4.x.xPersistent Transient FailureThe standard

What it means: A persistent transient failure is one in which the message as sent is valid, but persistence of some temporary condition has caused abandonment or delay of attempts to send the message. If this code accompanies a delivery failure report, sending in the future may be successful.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

5.x.xPermanent FailureThe standard

What it means: A permanent failure is one which is not likely to be resolved by resending the message in the current form. Some change to the message or the destination must be made for successful delivery.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.0.xOther or Undefined StatusThe standard

What it means: There is no additional subject information available.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.1.xAddressing StatusThe standard

What it means: The address status reports on the originator or destination address. It may include address syntax or validity. These errors can generally be corrected by the sender and retried.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.2.xMailbox StatusThe standard

What it means: Mailbox status indicates that something having to do with the mailbox has caused this DSN. Mailbox issues are assumed to be under the general control of the recipient.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.3.xMail System StatusThe standard

What it means: Mail system status indicates that something having to do with the destination system has caused this DSN. System issues are assumed to be under the general control of the destination system administrator.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.4.xNetwork and Routing StatusThe standard

What it means: The networking or routing codes report status about the delivery system itself. These system components include any necessary infrastructure such as directory and routing services. Network issues are assumed to be under the control of the destination or intermediate system administrator.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.5.xMail Delivery Protocol StatusThe standard

What it means: The mail delivery protocol status codes report failures involving the message delivery protocol. These failures include the full range of problems resulting from implementation errors or an unreliable connection.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.6.xMessage Content or Media StatusThe standard

What it means: The message content or media status codes report failures involving the content of the message. These codes report failures due to translation, transcoding, or otherwise unsupported message media. Message content or media issues are under the control of both the sender and the receiver, both of which must support a common set of supported content-types.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.xSecurity or Policy StatusThe standard

What it means: The security or policy status codes report failures involving policies such as per-recipient or per-host filtering and cryptographic operations. Security and policy status issues are assumed to be under the control of either or both the sender and recipient. Both the sender and recipient must permit the exchange of messages and arrange the exchange of necessary keys and certificates for cryptographic operations.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.0.0Other undefined StatusThe standard

What it means: Other undefined status is the only undefined error code. It should be used for all errors for which only the class of the error is known.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.1.0Other address statusThe standard

What it means: Something about the address specified in the message caused this DSN.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.1.1Bad destination mailbox addressThe standard

What it means: The mailbox specified in the address does not exist. For Internet mail names, this means the address portion to the left of the "@" sign is invalid.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.1.2Bad destination system addressThe standard

What it means: The destination system specified in the address does not exist or is incapable of accepting mail. For Internet mail names, this means the address portion to the right of the "@" is invalid for mail.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.1.3Bad destination mailbox address syntaxThe standard

What it means: The destination address was syntactically invalid. This can apply to any field in the address.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.1.4Destination mailbox address ambiguousThe standard

What it means: The mailbox address as specified matches one or more recipients on the destination system. This may result if a heuristic address mapping algorithm is used to map the specified address to a local mailbox name.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.1.6Destination mailbox has moved, No forwarding addressThe standard

What it means: The mailbox address provided was at one time valid, but mail is no longer being accepted for that address. This code is only useful for permanent failures.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.1.7Bad sender's mailbox address syntaxThe standard

What it means: The sender's address was syntactically invalid. This can apply to any field in the address.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.1.8Bad sender's system addressThe standard

What it means: The sender's system specified in the address does not exist or is incapable of accepting return mail. For domain names, this means the address portion to the right of the "@" is invalid for mail.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.1.9Message relayed to non-compliant mailerThe standard

What it means: The mailbox address specified was valid, but the message has been relayed to a system that does not speak this protocol; no further information can be provided.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.1.10Recipient address has null MXThe standard

What it means: This status code is returned when the associated address is marked as invalid using a null MX.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.2.0Other or undefined mailbox statusThe standard

What it means: The mailbox exists, but something about the destination mailbox has caused the sending of this DSN.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.2.1Mailbox disabled, not accepting messagesThe standard

What it means: The mailbox exists, but is not accepting messages. This may be a permanent error if the mailbox will never be re-enabled or a transient error if the mailbox is only temporarily disabled.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.2.2Mailbox fullThe standard

What it means: The mailbox is full because the user has exceeded a per-mailbox administrative quota or physical capacity. The general semantics implies that the recipient can delete messages to make more space available.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.2.3Message length exceeds administrative limitThe standard

What it means: A per-mailbox administrative message length limit has been exceeded. This status code should be used when the per-mailbox message length limit is less than the general system limit.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.2.4Mailing list expansion problemThe standard

What it means: The mailbox is a mailing list address and the mailing list was unable to be expanded. This code may represent a permanent failure or a persistent transient failure.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.3.0Other or undefined mail system statusThe standard

What it means: The destination system exists and normally accepts mail, but something about the system has caused the generation of this DSN.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.3.1Mail system fullThe standard

What it means: Mail system storage has been exceeded. The general semantics imply that the individual recipient may not be able to delete material to make room for additional messages.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.3.2System not accepting network messagesThe standard

What it means: The host on which the mailbox is resident is not accepting messages. Examples of such conditions include an imminent shutdown, excessive load, or system maintenance.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.3.3System not capable of selected featuresThe standard

What it means: Selected features specified for the message are not supported by the destination system. This can occur in gateways when features from one domain cannot be mapped onto the supported feature in another.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.3.4Message too big for systemThe standard

What it means: The message is larger than per-message size limit. This limit may either be for physical or administrative reasons.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.3.5System incorrectly configuredThe standard

What it means: The system is not configured in a manner that will permit it to accept this message.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.4.0Other or undefined network or routing statusThe standard

What it means: Something went wrong with the networking, but it is not clear what the problem is, or the problem cannot be well expressed with any of the other provided detail codes.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.4.1No answer from hostThe standard

What it means: The outbound connection attempt was not answered, because either the remote system was busy, or was unable to take a call. This is useful only as a persistent transient error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.4.2Bad connectionThe standard

What it means: The outbound connection was established, but was unable to complete the message transaction, either because of time-out, or inadequate connection quality. This is useful only as a persistent transient error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.4.3Directory server failureThe standard

What it means: The network system was unable to forward the message, because a directory server was unavailable. This is useful only as a persistent transient error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.4.4Unable to routeThe standard

What it means: The mail system was unable to determine the next hop for the message because the necessary routing information was unavailable from the directory server. This is useful for both permanent and persistent transient errors.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.4.5Mail system congestionThe standard

What it means: The mail system was unable to deliver the message because the mail system was congested. This is useful only as a persistent transient error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.4.6Routing loop detectedThe standard

What it means: A routing loop caused the message to be forwarded too many times, either because of incorrect routing tables or a user- forwarding loop. This is useful only as a persistent transient error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.4.7Delivery time expiredThe standard

What it means: The message was considered too old by the rejecting system, either because it remained on that host too long or because the time-to-live value specified by the sender of the message was exceeded. If possible, the code for the actual problem found when delivery was attempted should be returned rather than this code.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.5.0Other or undefined protocol statusThe standard

What it means: Something was wrong with the protocol necessary to deliver the message to the next hop and the problem cannot be well expressed with any of the other provided detail codes.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.5.1Invalid commandThe standard

What it means: A mail transaction protocol command was issued which was either out of sequence or unsupported. This is useful only as a permanent error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.5.2Syntax errorThe standard

What it means: A mail transaction protocol command was issued which could not be interpreted, either because the syntax was wrong or the command is unrecognized. This is useful only as a permanent error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.5.3Too many recipientsThe standard

What it means: More recipients were specified for the message than could have been delivered by the protocol. This error should normally result in the segmentation of the message into two, the remainder of the recipients to be delivered on a subsequent delivery attempt.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.5.4Invalid command argumentsThe standard

What it means: A valid mail transaction protocol command was issued with invalid arguments, either because the arguments were out of range or represented unrecognized features. This is useful only as a permanent error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.5.5Wrong protocol versionThe standard

What it means: A protocol version mis-match existed which could not be automatically resolved by the communicating parties.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.5.6Authentication Exchange line is too longThe standard

What it means: This enhanced status code SHOULD be returned when the server fails the AUTH command due to the client sending a [BASE64] response which is longer than the maximum buffer size available for the currently selected SASL mechanism. This is useful for both permanent and persistent transient errors.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.6.0Other or undefined media errorThe standard

What it means: Something about the content of a message caused it to be considered undeliverable and the problem cannot be well expressed with any of the other provided detail codes.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.6.1Media not supportedThe standard

What it means: The media of the message is not supported by either the delivery protocol or the next system in the forwarding path. This is useful only as a permanent error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.6.2Conversion required and prohibitedThe standard

What it means: The content of the message must be converted before it can be delivered and such conversion is not permitted. Such prohibitions may be the expression of the sender in the message itself or the policy of the sending host.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.6.3Conversion required but not supportedThe standard

What it means: The message content must be converted in order to be forwarded but such conversion is not possible or is not practical by a host in the forwarding path. This condition may result when an ESMTP gateway supports 8bit transport but is not able to downgrade the message to 7 bit as required for the next hop.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.6.5Conversion FailedThe standard

What it means: A conversion was required but was unsuccessful. This may be useful as a permanent or persistent temporary notification.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.6.6Message content not availableThe standard

What it means: The message content could not be fetched from a remote system. This may be useful as a permanent or persistent temporary notification.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.6.7Non-ASCII addresses not permitted for that sender/recipientThe standard

What it means: This indicates the reception of a MAIL or RCPT command that non-ASCII addresses are not permitted

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.6.8UTF-8 string reply is required, but not permitted by the SMTP clientThe standard

What it means: This indicates that a reply containing a UTF-8 string is required to show the mailbox name, but that form of response is not permitted by the SMTP client.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.6.9UTF-8 header message cannot be transferred to one or more recipients, so the message must be rejectedThe standard

What it means: This indicates that transaction failed after the final "." of the DATA command.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.0Other or undefined security statusThe standard

What it means: Something related to security caused the message to be returned, and the problem cannot be well expressed with any of the other provided detail codes. This status code may also be used when the condition cannot be further described because of security policies in force.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.1Delivery not authorized, message refusedThe standard

What it means: The sender is not authorized to send to the destination. This can be the result of per-host or per-recipient filtering.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.2Mailing list expansion prohibitedThe standard

What it means: The sender is not authorized to send a message to the intended mailing list. This is useful only as a permanent error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.3Security conversion required but not possibleThe standard

What it means: A conversion from one secure messaging protocol to another was required for delivery and such conversion was not possible. This is useful only as a permanent error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.4Security features not supportedThe standard

What it means: A message contained security features such as secure authentication that could not be supported on the delivery protocol. This is useful only as a permanent error.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.5Cryptographic failureThe standard

What it means: A transport system otherwise authorized to validate or decrypt a message in transport was unable to do so because necessary information such as key was not available or such information was invalid.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.6Cryptographic algorithm not supportedThe standard

What it means: A transport system otherwise authorized to validate or decrypt a message was unable to do so because the necessary algorithm was not supported.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.7Message integrity failureThe standard

What it means: A transport system otherwise authorized to validate a message was unable to do so because the message was corrupted or altered. This may be useful as a permanent, transient persistent, or successful delivery code.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.8Authentication credentials invalidThe standard

What it means: This response to the AUTH command indicates that the authentication failed due to invalid or insufficient authentication credentials. In this case, the client SHOULD ask the user to supply new credentials (such as by presenting a password dialog box).

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.9Authentication mechanism is too weakThe standard

What it means: This response to the AUTH command indicates that the selected authentication mechanism is weaker than server policy permits for that user. The client SHOULD retry with a new authentication mechanism.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.10Encryption NeededThe standard

What it means: This indicates that external strong privacy layer is needed in order to use the requested authentication mechanism. This is primarily intended for use with clear text authentication mechanisms.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.11Encryption required for requested authentication mechanismThe standard

What it means: This response to the AUTH command indicates that the selected authentication mechanism may only be used when the underlying SMTP connection is encrypted. Note that this response code is documented here for historical purposes only.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.12A password transition is neededThe standard

What it means: This response to the AUTH command indicates that the user needs to transition to the selected authentication mechanism. This is typically done by authenticating once using the [PLAIN] authentication mechanism.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.13User Account DisabledThe standard

What it means: Sometimes a system administrator will have to disable a user's account (e.g., due to lack of payment, abuse, evidence of a break-in attempt, etc). This error code occurs after a successful authentication to a disabled account.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.14Trust relationship requiredThe standard

What it means: The submission server requires a configured trust relationship with a third-party server in order to access the message content. This value replaces the prior use of X.7.8 for this error condition.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.15Priority Level is too lowThe standard

What it means: The specified priority level is below the lowest priority acceptable for the receiving SMTP server. This condition might be temporary, for example the server is operating in a mode where only higher priority messages are accepted for transfer and delivery, while lower priority messages are rejected.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.16Message is too big for the specified priorityThe standard

What it means: The message is too big for the specified priority. This condition might be temporary, for example the server is operating in a mode where only higher priority messages below certain size are accepted for transfer and delivery.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.17Mailbox owner has changedThe standard

What it means: This status code is returned when a message is received with a Require-Recipient-Valid-Since field or RRVS extension and the receiving system is able to determine that the intended recipient mailbox has not been under continuous ownership since the specified date-time.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.18Domain owner has changedThe standard

What it means: This status code is returned when a message is received with a Require-Recipient-Valid-Since field or RRVS extension and the receiving system wishes to disclose that the owner of the domain name of the recipient has changed since the specified date-time.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.19RRVS test cannot be completedThe standard

What it means: This status code is returned when a message is received with a Require-Recipient-Valid-Since field or RRVS extension and the receiving system cannot complete the requested evaluation because the required timestamp was not recorded. The message originator needs to decide whether to reissue the message without RRVS protection.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.20No passing DKIM signature foundThe standard

What it means: This status code is returned when a message did not contain any passing DKIM signatures. (This violates the advice of [Section 6.1 of RFC 6376].)

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.21No acceptable DKIM signature foundThe standard

What it means: This status code is returned when a message contains one or more passing DKIM signatures, but none are acceptable. (This violates the advice of [Section 6.1 of RFC 6376].)

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.22No valid author-matched DKIM signature foundThe standard

What it means: This status code is returned when a message contains one or more passing DKIM signatures, but none are acceptable because none have an identifier(s) that matches the author address(es) found in the From header field. This is a special case of X.7.21.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.23SPF validation failedThe standard

What it means: This status code is returned when a message completed an SPF check that produced a "fail" result, contrary to local policy requirements. Used in place of 5.7.1 as described in [Section 8.4 of RFC 7208].

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.24SPF validation errorThe standard

What it means: This status code is returned when evaluation of SPF relative to an arriving message resulted in an error. Used in place of 4.4.3 or 5.5.2 as described in [Sections 8.6, 8.7 of RFC 7208].

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.25Reverse DNS validation failedThe standard

What it means: This status code is returned when an SMTP client's IP address failed a reverse DNS validation check, contrary to local policy requirements.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.26Multiple authentication checks failedThe standard

What it means: This status code is returned when a message failed more than one message authentication check, contrary to local policy requirements. The particular mechanisms that failed are not specified.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.27Sender address has null MXThe standard

What it means: This status code is returned when the associated sender address has a null MX, and the SMTP receiver is configured to reject mail from such sender (e.g., because it could not return a DSN).

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.28Mail flood detectedThe standard

What it means: The message appears to be part of a mail flood of similar abusive messages.

Source: iana.org (opens in a new tab). Checked Nov 9, 2026.

x.7.29ARC validation failureThe standard

What it means: This status code may be returned when a message fails ARC validation.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

x.7.30REQUIRETLS support requiredThe standard

What it means: This indicates that the message was not able to be forwarded because it was received with a REQUIRETLS requirement and none of the SMTP servers to which the message should be forwarded provide this support.

Source: iana.org (opens in a new tab), rfc-editor.org (opens in a new tab). Checked Nov 9, 2026.

How to fix 550 5.7.509 access denied by DMARC

How to read the result

What the headers tell you

What to do next

550 5.7.509: common questions

Is 550 5.7.509 a hard bounce?

Why does only one Microsoft recipient bounce with 5.7.509?

Should I set my DMARC policy to none to stop 550 5.7.509?

Keep going