550: too many invalid recipients (harvest protection)
Your server tried too many addresses that do not exist at this company within an hour, so the Cisco gateway’s harvest protection is refusing it.
- Cisco Secure Email
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 Too many invalid recipients.
What it means
Cisco Secure Email Gateway has Directory Harvest Attack Prevention: it counts how many invalid recipients a remote host tries per hour and, past the limit, rejects or drops the connection. Cisco’s default reply is 550 with this text. The protection exists to stop spammers guessing addresses, so a legitimate sender meets it when a list carries many dead or guessed addresses at one company. The count is kept per sending host, and once it is passed the gateway can drop the connection, so other messages from your server may fail as well until the count falls.
Common causes
- A list with many outdated, mistyped or guessed addresses at the same company.
- Address patterns generated by a tool rather than verified.
- People who have left the company still on your list.
How to fix it
- 01Stop sending to that company for now and remove addresses that bounced as unknown.
- 02Verify the remaining addresses before sending again.
- 03Send to verified addresses only from then on; guessing patterns is what this protection is built to catch.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
550 at other providers
- 550 [SC-001]Outlook.com policy block for content or reputation.Outlook.com rejected the mail for policy reasons tied to spam-like content or to the reputation of the sending IP or domain.
- 550 [SC-002]Outlook.com block for namespace mining.Outlook.com blocked the sending IP because it behaved like a namespace miner, checking whether addresses exist without sending mail.
- 550 [SC-003]Outlook.com block for an open proxy or relay.Outlook.com rejected the mail because the sending IP appears to be an open proxy or open relay.
- 550 [SC-004]Outlook.com block after complaints.Outlook.com placed a block on the sending IP because it received complaints about mail coming from it.
- 550 [DY-001]Outlook.com refuses dynamic IP addresses.Outlook.com rejected the mail because the sending IP is dynamic address space, which it generally does not accept mail from.
- 550 [DY-002]Outlook.com block for a likely compromised sender.Outlook.com rejected the mail because the sending server or computer appears to be compromised or infected.
Further reading
All 7 Cisco Secure Email codesEvery code in the wikiPaste your own bounce