Email bounce codes explained: 550 5.7.26, 5.7.1, 5.1.1 and more

Sent by: Gmail, and other receivers that enforce DMARC

The message failed DMARC: neither SPF nor DKIM passed for the domain in the From line. Either the sending service is not set up for your domain, or someone is sending as you.

1. Find which service sent the bounced mail: your mail host, a newsletter tool, a webshop, invoicing software.
2. Add that service to your SPF record and turn on DKIM signing for your domain inside the service.
3. Run a mail check to confirm SPF, DKIM and DMARC all pass before sending again.

Sent by: Outlook.com, Hotmail and Live

Microsoft's consumer mail now rejects bulk mail without SPF, DKIM and DMARC in place. Your domain is missing one of them, or one fails.

1. Publish SPF and DKIM for every service that sends as your domain.
2. Publish a DMARC record, at least p=none.
3. Make sure SPF or DKIM aligns with the From domain, not only with the sending service's own domain.

Sent by: Any receiver that checks SPF strictly

The server that sent the message is not listed in your domain's SPF record, and the record ends in -all.

1. Add the sending server or service to your SPF record with include: or ip4:.
2. Check that you have one SPF record, not two.
3. Keep the record under 10 DNS lookups.

Sent by: Receivers that require DKIM

The message had no DKIM signature, or every signature on it failed. Common after a forwarding server changed the message, or when signing was never turned on.

1. Turn on DKIM signing in the sending service and publish its key in DNS.
2. Check the selector in the DKIM-Signature header matches a record that exists.
3. If a mailing list or forwarder sits in between, check whether it rewrites the body or subject.

Sent by: Gmail and many corporate filters

The sending IP address has no PTR record, or the name it points to does not resolve back to the same address.

1. Ask whoever runs the sending server (your host or provider) to set a PTR record for the IP.
2. Make the PTR name resolve back to the same IP with an A or AAAA record.
3. On a shared mail service this is their job, not yours: send them the bounce.

Sent by: Almost every mail server; the text after it says why

A catch-all for 'the receiver refuses this'. The text that follows names the reason: a blocklist such as Spamhaus, spam content, relaying not allowed, or a local rule.

1. Read the text after the code. A URL in it usually points to the blocklist or the receiver's policy page.
2. Check the sending IP on the blocklist named, then follow its delisting steps.
3. Find out why it was listed first (a hacked account, a contact form sending spam), or it gets listed again.

Sent by: Microsoft 365, Exchange, Postfix and many others

The same family as 554 5.7.1. At Microsoft it often means your IP is on their block list, or the recipient's organisation only accepts mail from certain senders. On your own server it often means 'Relay access denied': the server will not pass mail on for an unauthenticated sender.

1. For a Microsoft block: request delisting through the Office 365 delist portal linked in the bounce.
2. For 'Relay access denied': your mail app is not logging in to the SMTP server. Turn on SMTP authentication.
3. For a recipient-only rule: ask the recipient to allow your address or domain.

Sent by: Outlook.com and Microsoft 365 (codes 5.7.606 to 5.7.649)

Microsoft has blocked the IP address the mail came from, usually after spam complaints from that address or its neighbours.

1. Use the delist link in the bounce to request removal for the IP.
2. If you are on a shared mail service, send them the bounce; it is their IP.
3. Check for a hacked mailbox or form on your side sending spam.

Sent by: Gmail

Gmail sees a spike of mail from your IP or domain that looks like spam, and is slowing it down. It is a temporary refusal; the sending server will retry.

1. Slow down: send large mailings in batches over hours, not all at once.
2. Only mail people who asked for it, and offer a one-click unsubscribe.
3. Check your spam complaint rate in Google Postmaster Tools.

Sent by: Servers that use greylisting, and busy servers

The receiver asks unknown senders to come back in a few minutes. Real mail servers do; most spam tools do not. The mail usually arrives with a delay of 5 to 15 minutes.

1. Nothing, in most cases. Wait and the retry goes through.
2. If it keeps failing for hours, check the receiver is not blocking you: look for a blocklist in the text.

Sent by: Gmail and others

A temporary refusal. At Gmail it often comes with a note about authentication or an unusual rate; elsewhere it can mean the server is busy or TLS is required.

1. Read the text after the code for the reason.
2. If it mentions authentication, fix SPF and DKIM (see 550 5.7.26).
3. If it mentions TLS, make sure your server offers STARTTLS with a valid certificate.

Sent by: Gmail

The person you are mailing gets more mail than their mailbox accepts per minute. It is about them, not you.

1. Nothing: the retry will get through once the rate drops.
2. If you send them many messages at once, spread them out.

Sent by: Your own mail server, in a 'delivery delayed' or final bounce

Your server tried to deliver the message for days and never got through. The real reason is in the earlier attempts: an unreachable server, a timeout, or one of the temporary codes above.

1. Check the recipient's domain still has working MX records (a DNS check shows this).
2. Look at the diagnostic text in the bounce for the last error seen.
3. If one domain keeps failing, ask the recipient to check with their mail host.

Sent by: Every mail server

The mailbox does not exist at that domain. A typo, someone who left the company, or an old address.

1. Check the spelling, especially after the @.
2. Ask the person for their current address another way.
3. Remove the address from mailing lists: repeated bounces to dead addresses hurt your reputation.

Sent by: Microsoft 365 and Outlook.com

Microsoft's version of 'user unknown'. The address is not in the recipient organisation's directory.

1. Check the address for typos.
2. If it worked before, the person may have left, or their organisation renamed the address.

Sent by: Gmail, Yahoo and others

The account exists but is switched off, often because it has not been used for a long time.

1. Contact the person another way and ask for a working address.
2. Remove it from your lists.

Sent by: Every mail server

The recipient's mailbox has no room left. Sometimes sent as a temporary 452 4.2.2 first.

1. Tell the recipient another way; only they can make room.
2. Try again later, or send a smaller message.

Sent by: Microsoft 365 (directory-based edge blocking)

Microsoft rejected the address at the edge because it is not a valid recipient in that organisation, or the organisation does not accept mail from outside for it.

1. Check the address with the recipient.
2. If the address is right, the recipient's IT has to allow external mail to it.

Sent by: Every mail server

The address is not a valid email address: a space, a missing part, a comma, or two @ signs.

1. Look for a space, a trailing dot, or a comma where a dot should be.
2. Copy the address from a mail the person sent you instead of typing it.

Sent by: Every mail server

The message is over the receiver's size limit. Many accept 25 MB, some only 10 MB, and attachments grow by about a third when encoded for mail.

1. Send large files as a download link from file storage instead of as an attachment.
2. Compress photos and PDFs before attaching them.

Sent by: Gmail

Gmail blocks file types that can run code (.exe, .js, .vbs and others), also inside zip files, and documents with suspicious macros.

1. Share the file through file storage with a link instead.
2. Save documents as PDF before sending.

Sent by: Your outgoing (SMTP) mail server

Your mail app tried to log in to send and the username or password was refused.

1. Check the username is the full email address and the password is current.
2. Some providers need an app password or OAuth instead of your normal password.
3. Too many failed tries can lock the account for a while.

Sent by: Your outgoing mail server, or a receiver that requires encryption

The server only talks over an encrypted connection and your app did not start one.

1. In your mail app, set outgoing security to STARTTLS (port 587) or SSL/TLS (port 465).
2. Do not use port 25 from a mail app; it is for server-to-server mail.

Sent by: Microsoft 365 and other servers

The message went round in circles between servers, usually because two forwarding rules point at each other or MX records point to the wrong place.

1. Look for forwarding rules that send mail back to where it came from.
2. Check your MX records point to the server that actually holds your mailboxes.