Common error codes explained
Module 6: Bounces and troubleshooting · Reading time: 12 minutes
Learning objective: After this lesson you'll recognise the error codes you encounter most often, know their cause, and know who needs to fix them: you as the sender, the recipient, or the administrator of a mail server.
Key concepts: address unknown (5.1.1), mailbox full (4.2.2 / 5.2.2), message too large (5.3.4), no route (5.4.x), expired in queue (4.4.7), relay denied (5.7.1), unauthenticated (Gmail 5.7.26), PTR missing (Gmail 5.7.25), rate too high (4.7.28), Microsoft 4.7.500, 5.7.509, 5.7.515, 5.7.606, 5.7.708, T-Online IP block, sending limit
First: who needs to act?
An error code is only useful once you know who's responsible. So start by sorting every bounce into one of these four categories:
- The recipient's address or mailbox (
5.1.x,x.2.x): the address doesn't exist, or the mailbox is full or disabled. You can only check the address or warn the recipient some other way. - Your settings as the sender (for example
5.7.1 relaying denied, login errors, sending limit): you adjust something in your mail program or your package. - Your domain (SPF, DKIM, DMARC; Gmail
5.7.26, Microsoft5.7.509and5.7.515): you adjust your DNS, or have it adjusted for you. - The sending server (PTR, blocklist, reputation; Gmail
5.7.25and4.7.28, Microsoft4.7.500and5.7.606, T-Online): the server's administrator fixes it. With a hosting package or mail service, that's your provider.
Address and mailbox
| Code (example text) | Cause | What do you do? |
|---|---|---|
550 5.1.1 User unknown, Recipient address rejected, mailbox unavailable | The address doesn't exist at the recipient | Check the spelling. If it's correct, ask the recipient via another route whether the address still exists |
550 5.1.10 (Microsoft), RecipientNotFound | Same, at Microsoft 365 | Same |
5.1.2, Host or domain name not found | The domain doesn't exist or has no mail server (no MX and no A) | Typo in the domain (gmial.com)? Or the recipient's domain has expired or is set up incorrectly |
452 4.2.2 or 552 5.2.2, mailbox full, quota exceeded, out of storage space | The recipient's mailbox is full | The recipient needs to free up space. With 4.2.2 your server will still try again; with 5.2.2 it's final. Gmail uses 552 5.2.2 for a full mailbox that has also been inactive for a long time |
450 4.2.1, receiving mail too quickly | The recipient is getting too much mail in a short time | Wait, your server will try again |
552 5.3.4, message size exceeds, message too big | The message with attachments is larger than the recipient allows | Use a smaller attachment, or share the file via a link. Note: encoding makes attachments roughly a third larger (lesson 3.2) |
Your own sending settings
| Code (example text) | Cause | What do you do? |
|---|---|---|
550 5.7.1 Relaying denied, Relay access denied | Your mail program isn't logging in to the outgoing server, so it refuses to pass mail on to other domains | Turn on authentication for the outgoing server (lessons 1.4, 2.1) |
535 5.7.8 Authentication failed | Wrong username or password when sending | Use the full email address as the username, test the password in webmail |
550 5.4.5 Daily sending quota exceeded, message limit reached | You've reached the sending limit of your mailbox or package | Wait until the limit resets. Don't send much mail? Then your mailbox may have been misused: change the password immediately |
553 5.7.1 ... not owned by user, can not send emails from | The sender address doesn't belong to the mailbox you're logging in with | Send from your own address, or set up the alias as prescribed by your provider (lesson 3.3) |
4.4.7, Message expired, retry timeout exceeded | The mail sat in the queue for days and couldn't be delivered | Look at the earlier deferral messages: those have the real reason |
Your domain: authentication
| Code (example text) | Cause | What do you do? |
|---|---|---|
550 5.7.26 ... sender is unauthenticated (Gmail) | Both SPF and DKIM fail, or DMARC fails | Add the service that sent the mail to SPF, turn on DKIM, check alignment (module 4) |
550 5.7.27 (Gmail) | SPF failed | Include the sending server in your SPF; watch the ten-lookup limit |
550 5.7.30 / 421 4.7.30 (Gmail) | DKIM failed | Check the DKIM key with the selector from the mail |
421 4.7.32 / 550 5.7.32 (Gmail) | The From: domain isn't aligned with SPF or DKIM | Set up your own DKIM for your domain with the sending service, or your own Return-Path |
421 4.7.31 (Gmail) | Bulk sender without a DMARC record | Add a DMARC record, at least p=none |
550 5.7.509 Access denied, sending domain ... does not pass DMARC verification and has a DMARC policy of reject (Microsoft) | DMARC fails and your own policy is set to reject | Find out which source isn't aligned (DMARC report, lesson 4.5). This is exactly why you start with p=none |
550 5.7.515 Access denied, sending domain ... does not meet the required authentication level (Microsoft) | Bulk sender to Outlook.com where SPF or DKIM fails, or DMARC is missing | Make both SPF and DKIM pass, add a DMARC record (lesson 5.3) |
550 5.7.23 ... Sender Policy Framework violation (Microsoft) | SPF fails at a recipient that filters strictly on SPF | Add to SPF |
550 5.7.1 DMARC check failed (other servers) | Same, with a generic code | Same |
One thing to note with 5.7.509: the bounce names your domain, but the cause isn't always your regular mail. Often it's a website, webshop or accounting package sending on behalf of your domain without that service being in your SPF or signing with your DKIM. Look in the headers of the original mail at the bottom of the bounce for the Return-Path and the sending server.
The sending server: PTR, reputation and blocklists
| Code (example text) | Cause | Who fixes it? |
|---|---|---|
550 5.7.25 ... doesn't have a PTR record (Gmail) | The sending server's IP address has no (correct) reverse DNS, often via IPv6 | The server's administrator (lesson 5.1) |
421 4.7.23 (Gmail) | Same, temporary version | Same |
550 5.7.29 / 421 4.7.29 (Gmail) | Not sent via TLS | The server's administrator |
421 4.7.28 ... unusual rate of email (Gmail), 550 5.7.28 ... unusual rate of unsolicited email | Too much mail, or too much unwanted mail, from this IP address | Reduce the rate; with a final refusal, fix the cause first (spam, a purchased list) |
451 4.7.500 Server busy. Please try again later from [IP] (Microsoft) | Microsoft is temporarily throttling the IP address, often because it's new or the volume has suddenly increased | Wait, the server will try again; the administrator warms up the IP and registers it with SNDS (lesson 6.4). Microsoft also documents the 4.7.500 to 4.7.699 range as "Access denied, please try again later" for suspicious activity |
550 5.7.606 to 5.7.649 Access denied, banned sending IP [IP] (Microsoft) | The IP address has been blocked by Microsoft | The administrator requests removal via sender.office.com, after fixing the cause |
550 5.7.708 Access denied, traffic not accepted from this IP (Microsoft 365, outgoing) | Traffic from this IP or this Microsoft 365 environment isn't being accepted, often after misuse | The administrator of the Microsoft 365 environment, via Microsoft support |
554 ... blocked using zen.spamhaus.org, listed at, RBL | The IP address is on a blocklist | The server's administrator, after fixing the cause (lesson 5.2) |
554 IP=192.0.2.25 - A problem occurred and similar messages with "bad reputation" (T-Online) | T-Online has blocked the IP address, based on its own reputation data | The sending server's administrator contacts T-Online (lesson 6.4) |
421 Maximum parallel connections for your IP-Address reached (T-Online) | Too many simultaneous connections | The administrator limits the number of connections; the mail will still arrive later |
How do you look up an unknown code?
- Check who gave it. The name in
Remote-MTAor afterhosttells you which party it is:google.com,outlook.comorprotection.outlook.com,t-online.de, and so on. - Look up the code with that party. Google has a page called "Gmail SMTP errors and codes", Microsoft has "Email nondelivery reports and SMTP errors in Exchange Online", and Yahoo and T-Online have postmaster pages. These are more reliable than a random forum.
- Read the text that follows. With large recipients there's often a link or a code in brackets (such as
(AS843)at Microsoft) that states exactly what's going on. - Look at the original mail at the bottom of the bounce. Which sender address, which Return-Path, which server? With SPF and DMARC errors, that's where the answer lies.
In practice
At WebOké, the knowledge base has a list of common messages, and in DirectAdmin you can see the literal response from the receiving server in E-mail Tracking. With other providers a log like this usually exists too, sometimes only for the administrator. If you ask a provider for help, always include the full bounce, with the line containing the code, the sender address, the recipient's address and the time. A summary like "my mail isn't arriving" can't be looked up by anyone.
Summary
- First sort every code: the recipient's address/mailbox, your own sending settings, your domain, or the sending server.
5.1.1address doesn't exist,x.2.2mailbox full,5.3.4too large,5.7.1 relaying deniednot logged in.- Authentication: Gmail
5.7.26/5.7.27/5.7.30, Microsoft5.7.509(DMARC with reject) and5.7.515(bulk). - Server: Gmail
5.7.25(PTR), Microsoft4.7.500(temporarily throttled) and5.7.606(IP blocked), T-Online IP blocks. - Look up an unknown code with the party that gave it, and read the original mail at the bottom.
Quiz
Exercise
Exercise Z6.2: Matching codes to causes. You'll be given ten real error messages (with example domains and documentation addresses) and a list of causes and who needs to act. Match each message to the right cause and the right party. The program checks your answers against a fixed key and gives an explanation for each error answer.
Further reading
The steps in these articles apply to WebOké's panels; with other providers it works in a similar way.
- DirectAdmin guide 9.5: Sending refused: blacklists and limits
- Mail delivery failed: how to read the error message and what the codes mean
- Email rejected: message too big
- Sending email: Too many recipients
- Limit for sending mail
- Sending email from multiple aliases, error: Account xxx can not send emails from
- DirectAdmin guide 18.10: I can't send email
- Google, Gmail SMTP errors and codes: https://support.google.com/a/answer/3726730
- Microsoft, Email nondelivery reports and SMTP errors in Exchange Online: https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/non-delivery-reports-in-exchange-online
- T-Online Postmaster: https://postmaster.t-online.de/