Find out why your email bounced
Paste the bounce message you got back. The lookup picks out the codes, works out which provider sent it and opens the entry that explains it: the cause, the fix and the source it rests on.
The lookup needs JavaScript. Every code in the wiki is also listed as a plain link.
The whole bounce works best: the lookup picks out the reply code, the enhanced code and any provider tag, and reads the wording for who sent it. A code on its own works too, such as 550 5.1.1, 421 or TSS04.
Browse by provider
The codes each provider documents for its own servers, explained against its own documentation.
- Gmail and Google WorkspaceGoogle runs Gmail and the mail service of Google Workspace, so its servers receive mail for gmail.com, googlemail.com and every business domain whose mail is hosted on Workspace.108 codes
- Microsoft (Outlook.com and Microsoft 365)Microsoft runs Outlook.com, the consumer service behind outlook.com, hotmail.com, live.com and msn.com addresses, and Exchange Online, which receives mail for business domains hosted on Microsoft 365.111 codes
- Yahoo and AOLYahoo runs Yahoo Mail and AOL Mail on one platform, so mail to yahoo.com, aol.com and the other domains it hosts faces the same sender rules and error codes.7 codes
- Comcast (Xfinity)Comcast runs Xfinity's consumer email, so mail to comcast.net addresses is received and filtered by Xfinity's mail servers.33 codes
- GMX, WEB.DE and mail.comGMX, WEB.DE and mail.com run on one mail platform with one postmaster team, so mail to their addresses meets the same filters and the same case-numbered error messages.57 codes
- IONOS (1&1)IONOS, formerly 1&1, hosts email for the domains of its customers, so mail to an address on an IONOS-hosted domain is received and filtered by IONOS mail servers.17 codes
- Telekom (t-online.de)Deutsche Telekom runs the t-online.de mailboxes of its German internet and freemail customers, and its own postmaster team handles the mail sent to them.3 codes
- Orange (orange.fr and wanadoo.fr)Orange, the French telecom operator, hosts the orange.fr and wanadoo.fr mailboxes of its customers and filters the mail sent to them.20 codes
- Free (free.fr)Free, the French internet provider, hosts the free.fr mailboxes of its subscribers and runs the outgoing servers they send through.6 codes
- FastmailFastmail is a paid email provider that hosts mailboxes on its own domains and on its customers' domains, and sends their outgoing mail.4 codes
- MimecastMimecast runs a cloud email security gateway that many companies point their MX records at, so its servers accept or refuse mail on behalf of those companies.19 codes
- ProofpointProofpoint sells email security to businesses and filters their incoming mail, scoring each sending IP with its own reputation system, Proofpoint Dynamic Reputation.3 codes
- Barracuda (Email Protection and Email Security Gateway)Barracuda Networks makes email security gateways, as appliances and as a cloud service, that screen incoming mail for businesses using its own reputation list among other checks.11 codes
- Cisco Secure Email (formerly IronPort)Cisco Secure Email Gateway, long known as IronPort, filters incoming mail for businesses on site or in Cisco’s cloud, using sender reputation data from Cisco Talos.7 codes
The standard codes
What every mail server sends: the three-digit reply codes of RFC 5321 and the enhanced status codes of RFC 3463, grouped the way the RFCs group them.
Reply codes, by class
5xxPermanent failures
The receiving server refused the message for good. Your server will not try again, and the message comes back to you as a bounce.
- 500Command not recognised
- 501Syntax error in arguments
- 502Command not implemented
- 503Bad sequence of commands
- 504Command parameter not implemented
- 521Host does not accept mail
- 530Authentication required
- 534Authentication method too weak
- 535Authentication credentials invalid
- 538Encryption required for this login method
- 550Mailbox unavailable
- 551User not local
- 552Storage allocation exceeded
- 553Mailbox name not allowed
- 554Transaction failed
- 555Parameters not recognised
- 556Domain does not accept mail
4xxTemporary failures
The receiving server cannot take the message now. Your server keeps it and retries, and only bounces it if the retries run out.
Enhanced status codes, by subject
The middle number says which part of delivery failed. RFC 3463 defines each subject and detail once for both classes, so 4.2.2 and 5.2.2 are the same problem, one temporary and one permanent.
X.0Other or undefined
No more specific subject applies.
X.1Addressing
The sender or recipient address: unknown, malformed or moved.
- 5.1.0Address problem, unspecified
- 5.1.1Mailbox does not exist
- 5.1.2Recipient domain cannot receive mail
- 5.1.3Recipient address is malformed
- 5.1.4Recipient address is ambiguous
- 5.1.6Mailbox has moved
- 5.1.7Sender address is malformed
- 5.1.8Sender domain cannot receive mail
- 556 5.1.10Recipient domain has a null MX
- 2.1.5Recipient address accepted
- 2.1.9Relayed to a system without tracking
X.2Mailbox
The recipient mailbox exists but cannot take the message: full, disabled, too big.
X.3Mail system
The receiving system itself: full, not accepting mail, misconfigured, a size limit.
X.4Network and routing
Getting to the server: no answer, bad DNS, a routing loop, delivery time expired.
X.5Mail delivery protocol
The SMTP conversation: a command out of order, bad syntax, too many recipients.
X.6Message content or media
The message itself: a format or encoding the server will not accept.
- 5.6.0Message content problem, unspecified
- 5.6.1Content type not supported
- 5.6.2Conversion needed but not allowed
- 5.6.3Conversion needed but not possible
- 5.6.5Conversion failed
- 5.6.6Message content not available
- 5.6.7Non-ASCII address not allowed
- 5.6.8UTF-8 reply needed but not allowed
- 5.6.9Internationalised message cannot be delivered
- 5.6.10Deprecated duplicate of 5.6.8
- 2.6.4Delivered after a lossy conversion
X.7Security or policy
Refused by rule: authentication, reputation and policy blocks all sit here.
- 5.7.0Security or policy refusal, unspecified
- 5.7.1Delivery not authorised
- 5.7.2Not allowed to send to this list
- 5.7.3Secure format conversion not possible
- 5.7.4Security feature not supported
- 5.7.5Cryptographic failure
- 5.7.6Cryptographic algorithm not supported
- 5.7.7Message integrity check failed
- 5.7.10Encryption needed
- 5.7.13User account disabled
- 5.7.14Trust relationship required
- 5.7.15Priority too low
- 5.7.17Mailbox owner has changed
- 5.7.18Domain owner has changed
- 5.7.19Ownership check could not be done
- 5.7.24SPF check error
- 5.7.28Mail flood detected
- 5.7.29ARC validation failed
- 5.7.30REQUIRETLS not supported by the next server
- 534 5.7.9Authentication method too weak
- 535 5.7.8Login failed: invalid credentials
- 538 5.7.11Encryption required for this login method
- 550 5.7.20No valid DKIM signature
- 550 5.7.21No acceptable DKIM signature
- 550 5.7.22No DKIM signature from the From domain
- 550 5.7.23SPF check failed
- 550 5.7.25Reverse DNS check failed
- 550 5.7.26Multiple authentication checks failed
- 550 5.7.27Sender domain has a null MX
- 552 5.7.16Too big for its priority
- 432 4.7.12Password transition needed
How to read a bounce
A bounce can carry three codes before its text. Each answers a different question, and the first digit answers the most important one.
- The reply code,
421. Three digits from SMTP itself (RFC 5321), sent by every server. The first digit is the verdict: 2 accepted, 4 try again later, 5 refused for good. - The enhanced status code,
4.7.0. Class, subject and detail (RFC 3463). The class repeats the verdict, the subject says which part of delivery failed (7 is security or policy), and the detail narrows it down. Optional, though the large providers all send one. - The provider's own reference,
[TSS04]. A tag the provider defines for itself, in its own format (Microsoft's look like S3140). Only its own documentation explains it, which is why the wiki files these codes by provider.
Temporary or permanent
A 4xx is not a bounce yet. Your server keeps the message and tries again, and RFC 5321 says to keep trying for at least four to five days. If every retry fails, the bounce arrives then, usually saying the delivery time expired (4.4.7). A 5xx bounces at once, and sending the same message again gets the same answer until the cause is fixed.
Where to find the codes
In the bounce your server sends back, look for the Diagnostic-Code: line, or the receiving server's name followed by said:. Outlook's reports put them under “Remote server returned”. The text after the codes is written for people and differs between servers, so look up the codes rather than the wording.
A heartbeat for your email.
Beat runs every check on this site on a schedule: 41 checks, 33 blacklists and real inbox placement. The moment something breaks, it tells you what broke, why it matters, and the exact fix.
- SPFpass
- DKIMpass
- DMARCp=none
- Blacklists0 of 33
Illustrative. Your domain, every few hours.
Also from us:Pulse: your own sending infrastructureConsulting: $65/hr, no retainer