SMTP error codes, decoded
An SMTP error code has two parts: a three-digit reply code and an enhanced status code. The first digit is what matters most — 4 means try again later, 5 means never. The enhanced code narrows it, and the human text after it is where the provider tells you the actual reason.
Written by the SieveGuard team from the checks our own free tools run. Last reviewed .
Reading the line
Three pieces of information, and most people read only the first:
550 5.7.1 [203.0.113.7] Our system has detected that this message is likely unsolicited mail │ │ └ the part that actually tells you what to do │ └ enhanced status code: class.subject.detail └ reply code — the first digit is the whole story
| First digit | Class | Meaning | Your sender should |
|---|---|---|---|
| 4xx / 4.x.x | Transient | Try again later — greylisting, rate limit, temporary problem | Retry with backoff, for up to 24–72h |
| 5xx / 5.x.x | Permanent | Do not retry. This will never succeed | Suppress the address immediately |
| 2xx | Success | Accepted for delivery — not the same as delivered to an inbox | Nothing |
One distinction worth internalising: a 250 at the end of the conversation means the receiving server accepted the message. It does not mean a human will see it. Filtering happens after acceptance, which is exactly why spam placement produces no error at all.
The codes you will actually see
Grouped by what they are telling you rather than numerically, because the numeric order scatters related problems.
The address does not exist
| Code | Typical text | What to do |
|---|---|---|
| 550 5.1.1 | User unknown / no such user here / recipient rejected | Suppress permanently. This is a hard bounce |
| 550 5.1.10 | Recipient not found by SMTP address lookup (Microsoft) | Suppress permanently |
| 553 5.1.3 | Invalid address syntax | Fix or drop — the address is malformed |
These are the bounces that count toward the roughly 2% threshold providers act on. They are individually harmless and collectively a statement about how you built your list.
You are being refused on reputation
| Code | Typical text | What it means |
|---|---|---|
| 550 5.7.1 | Message likely unsolicited (Gmail) / access denied (Microsoft) | The most common reputation refusal |
| 550 5.7.606 | Access denied, banned sending IP (Microsoft) | Your IP is on Microsoft’s block list — use their delist portal |
| 554 5.7.1 | Service unavailable, client host blocked | Usually a DNSBL hit at the receiver |
| 421 4.7.0 | Try again later, messages deferred due to reputation | Throttled, not blocked. Slow down |
| 550 5.7.26 | Unauthenticated email is not accepted (Gmail) | Authentication, not reputation — see below |
550 5.7.1 is the one most people arrive here for, and the text after it is the diagnosis, not the code. Gmail’s "likely unsolicited" is a reputation verdict; Microsoft’s "access denied" with the same code usually means an IP block. Same numbers, unrelated remedies — start from which reputation is broken.
Authentication is failing
| Code | Typical text | Cause |
|---|---|---|
| 550 5.7.26 | Unauthenticated email from this domain is not accepted | No SPF or DKIM pass at all |
| 550 5.7.509 | Access denied, sending domain does not pass DMARC (Microsoft) | Aligned pass missing |
| 550 5.7.1 … DMARC policy | Rejected per the domain’s DMARC policy | Your own p=reject, applied to your own mail |
The third row catches people out badly: your DMARC policy applies to everyone sending as your domain, including the sender you forgot to authenticate. If these appeared right after you moved to p=reject, the cause is alignment, not the receiver.
You are sending too fast
| Code | Typical text | What to do |
|---|---|---|
| 421 4.7.28 | Unusual rate of unsolicited mail (Gmail) | Reduce rate and volume. A warning shot |
| 452 4.2.2 | Mailbox full | Retry; suppress after repeated failures |
| 450 4.2.1 | Mailbox temporarily disabled | Retry over a few days |
| 421 4.4.5 / 4.3.2 | Too many connections / service not available | Reduce concurrency, not just volume |
Every one of these is a 4xx, which means retry — but retrying at the same rate that caused it converts a throttle into a block. The correct response is to back off, and for a new domain that usually means ramping more slowly.
Greylisting
451 4.7.1 with text about trying again later is usually greylisting: the receiver deliberately rejects the first attempt from an unknown sender, because most spam software never retries. Legitimate mail retries and gets through minutes later.
Nothing to fix — but if your sender does not retry 4xx correctly, this looks like a delivery failure when it is a working anti-spam measure.
Where the code comes from in the conversation
Which command drew the error narrows the cause immediately, and a transcript shows you that directly:
220 mx.example-mail.net ESMTP ← connection accepted EHLO sender.yourdomain.com 250-mx.example-mail.net MAIL FROM:<bounces@yourdomain.com> 250 2.1.0 Ok ← envelope sender accepted RCPT TO:<someone@example-mail.net> 550 5.1.1 User unknown ← recipient rejected: the ADDRESS is the problem DATA 550 5.7.1 … ← would mean the MESSAGE is the problem
- Rejected at connection — IP-level block, usually a DNSBL or a reverse-DNS problem.
- Rejected at MAIL FROM — sender domain or SPF.
- Rejected at RCPT TO — the recipient address itself.
- Rejected after DATA — content, size, or a reputation verdict on the message.
Our SMTP test tool runs this conversation live and shows the full transcript, which is faster than inferring the stage from a bounce message.
Two rules worth following
- Never retry a 5xx. It is permanent by definition, and repeatedly presenting a message that has been permanently refused is itself a negative signal.
- Suppress hard bounces immediately, not eventually. The address is gone. Every further attempt adds to a bounce rate that providers read as evidence you do not maintain your list.
Sources
FAQ
What does 550 5.7.1 mean?+
That the receiver refused the message permanently for policy reasons, and the text after the code is where the actual reason lives. At Gmail it usually signals a reputation verdict on unsolicited-looking mail; at Microsoft the same code with "access denied" normally means an IP block. Same digits, different remedies.
What is the difference between a 4xx and a 5xx?+
4xx is transient — retry with backoff and it may well succeed. 5xx is permanent — it will never succeed, so retrying is both pointless and a negative signal. The first digit is the single most useful thing in the whole line.
What does 550 5.1.1 mean?+
The recipient address does not exist. That is a hard bounce, and the address should be suppressed permanently on the first occurrence. These are what count toward the bounce-rate threshold providers act on.
Why do I get 421 4.7.0 deferrals?+
You are being throttled rather than blocked — usually because volume or rate rose faster than the receiver expects from you. Retry with genuine backoff. Retrying at the same rate that triggered it is how a throttle turns into a block.
My mail was accepted with 250 but never arrived. Why?+
Because 250 means accepted for delivery, not delivered to an inbox. Filtering happens after acceptance, so a message can be accepted cleanly and filed in spam or dropped silently. That is exactly why spam placement produces no error to debug.
What is greylisting?+
A deliberate temporary rejection of the first delivery attempt from an unknown sender, usually 451 4.7.1. Most spam software never retries, so retrying is itself the test. Legitimate mail arrives minutes later and there is nothing to fix.
Check it on a real domain
Free, no signup, DNS-only. Nothing you type leaves the lookup.