Email Bounce Back Error Codes: 550, 554, 421, 5.7.26 & Fixes

How to read a bounce code

Bounces carry two codes. The basic SMTP reply is three digits (550, 421). The enhanced status code that follows it has three parts, such as 5.1.1: class, subject, detail.

The first digit is what matters most. A 4 means a temporary failure — your server will keep retrying for a while, usually up to a few days, and the message may still arrive. A 5 means a permanent failure — nothing will be retried and you must change something before resending. The middle digit hints at the area: x.1.x is addressing, x.2.x is the mailbox, x.4.x is network or routing, and x.7.x is security or policy (authentication, spam, blocks).

Always read the human text after the code too. Two servers can both say 550 5.7.1 for completely different reasons, and the text tells you which.

Address and mailbox errors (5.1.x and 5.2.x)

• 550 5.1.1 — "User unknown", "Recipient address rejected" or "The email account that you tried to reach does not exist". The mailbox is not there. Check the spelling, especially the domain (gmial.com, outlok.com), and confirm with the recipient. Remove it from any mailing list: repeated sends to non-existent addresses damage your reputation.
• 550 5.1.10 (Microsoft) — RecipientNotFound: the address does not exist in the recipient’s Microsoft 365 directory. Same fix as 5.1.1.
• 552 5.2.2 — "Mailbox full" or "over quota". The recipient’s mailbox has no room. It is their problem to fix; tell them by another channel and resend later. Some servers return 452 4.2.2 for the same thing, which is temporary and may clear on retry.
• 552 5.3.4 — "Message size exceeds fixed limit". Your email, after attachments are encoded (which adds roughly 33%), is too big for the receiver. Send a download link instead of a large attachment.
• 553 5.1.3 / 553 5.1.8 — the address syntax is invalid or the sender domain is rejected. Often caused by a typo, a stray space or a malformed From: address set by an app. 553 with "relaying denied" or "sender not authorised" usually means your app is trying to send through a server it has not logged in to — enable SMTP authentication.

Policy and spam rejections (5.7.x)

• 550 5.7.1 — a catch-all policy rejection. Common texts: "Relaying denied" (you are not authenticated on the outgoing server — turn on SMTP AUTH in your client), "Message rejected as spam", or "Service unavailable; client host blocked using Spamhaus". Read the text: if it names a blocklist, look up the listed IP or domain on that list.
• 554 5.7.1 — similar to 550 5.7.1 but often issued after the message body has been scanned, meaning the content, a link or an attachment triggered the filter. Remove link shorteners, risky attachments and suspicious links, then retry.
• 550 5.7.25 (Gmail) — the sending IP has no PTR (reverse DNS) record. This is your mail provider’s responsibility to set up; contact them with the bounce.
• 550 5.7.26 (Gmail) — "Unauthenticated email from yourdomain.com is not accepted due to domain’s DMARC policy" or "this message is not authenticated". Your message failed DMARC: neither SPF nor DKIM passed with a domain aligned to your From: address. Publish DKIM for every service sending as you and add those services to SPF.
• 550 5.7.515 (Outlook.com) — "Access denied, sending domain does not meet the required authentication level". Microsoft now requires SPF, DKIM and DMARC from high-volume senders to Outlook.com, Hotmail and Live addresses. Fix exactly as for 5.7.26.
• 550 5.7.606 – 5.7.649 (Microsoft) — "Access denied, banned sending IP". The sending IP is on Microsoft’s own block list. Your provider must delist it through Microsoft’s delisting portal.

Temporary errors (4xx) you can usually wait out

• 421 4.7.0 — "Try again later" or "Temporary System Problem". The receiver is rate-limiting you or is overloaded. Your server will retry automatically. If it persists, you are sending too much too fast for your reputation; slow down.
• 421 4.7.28 (Gmail) — "unusual rate of unsolicited mail" from your IP or domain. Gmail is throttling you because of complaints or a sudden volume spike. Pause bulk sends and fix list quality.
• 450 4.2.1 — the recipient is receiving mail too fast; retry later.
• 451 4.7.1 — often greylisting: the receiver deliberately rejects the first attempt from an unknown sender and accepts the retry a few minutes later. Legitimate servers retry automatically, so this usually resolves itself.
• 451 4.3.0 / 4.4.1 — a server or network problem on the receiving side, or a connection timeout. Wait; if it continues for more than a day, check the recipient domain’s MX records.

When the bounce is about your own setup

Some bounces point back at you rather than the recipient. If you see SPF or DMARC wording, look up your own domain in a DNS checker and confirm SPF has a single v=spf1 record, DKIM is published at the selector you sign with, and DMARC exists at _dmarc. If you see "relaying denied" or "authentication required", your mail app is not logging in to the outgoing (SMTP) server — re-enter the SMTP username and password and use port 587 with STARTTLS or 465 with SSL.

With HavitoMail, outbound mail is only accepted from domains you have verified, and the dashboard shows which DNS records are passing, so authentication bounces are usually fixed by completing the green checks in the DNS wizard.

Bounces that come from the sending side

Not every NDR comes from the recipient. If your own provider refuses a message — for example because you exceeded a daily recipient limit or tried to send from an address on a domain you have not verified — the bounce will name your provider’s server, not the recipient’s. These are fixed in your account settings, not by contacting the recipient.

Also beware of backscatter: bounces for messages you never sent. That means someone spoofed your address. It is a sign you need a DMARC policy of quarantine or reject, not a sign your mailbox is hacked.