Mail delivery failed: how to read the error message and what the codes mean
Do you get a mail back with the subject Mail delivery failed: returning message to sender, Undelivered Mail Returned to Sender or Delivery Status Notification (Failure)? Then your mail hasn't arrived. Such an error message is called a bounce. It comes from Mailer-Daemon or Mail Delivery System and almost always tells you what's wrong. Here's how to read it.
How to read a bounce
pieter@example.net host mx1.example.net [198.51.100.20] SMTP error from remote mail server after RCPT TO:<pieter@example.net>: 550 5.1.1 <pieter@example.net>: Recipient address rejected: User unknown
- For which address did it go wrong? With multiple recipients, the error only applies to this address.
- Who's reporting it? If it says SMTP error from remote mail server, then the recipient's server (after host) refused the mail. If it doesn't say that, our own server gave up, for example due to a limit.
- The code and the text after it: that's where the reason is.
In the technical part below, look at Remote-MTA (the server that refused) and Diagnostic-Code (its literal response). At the very bottom are the header lines of your original mail: there you can see which sender address and which server were used.
Temporary or permanent: the 4/5 rule
- If the code starts with a 5 (
550,5.7.1), the mail was permanently rejected. Resending will only help once the cause has been fixed. - If the code starts with a 4 (
451,4.7.500), it's temporary and our server will retry automatically. If you get a delay notice withAction: delayed, don't resend the mail, otherwise it might arrive twice.
The second number indicates where the problem lies: x.1 the address, x.2 the mailbox, x.3 the mail system, x.4 the connection, x.7 security and policy.
The most common codes
| Code or message | Meaning | Who needs to act? |
|---|---|---|
550 5.1.1 User unknown, Recipient address rejected | The address doesn't exist. | You: check the spelling. |
452 4.2.2 or 552 5.2.2 Mailbox full, Quota exceeded | The recipient's mailbox is full. | The recipient. |
552 5.3.4 Message too big | The message is too large. With us, it may be a maximum of 20 MB, including attachments. | You: share large files via a link, see Email rejected: message too big. |
550 5.7.1 Relaying denied | Your mail program isn't logging in to the outgoing server. | You: turn on authentication, see I can't send email (receiving does work). |
451 Daily send limit of 300 emails for account '...' is reached, message limit reached | Our daily limit has been reached: by default 300 emails per package per day, lower for some packages. | You: wait until tomorrow. If you don't send much yourself, your mailbox may have been misused. See Limit for sending mail. |
550 5.7.1 with different text | The recipient refuses the mail due to their own policy, such as spam. The text says why. | Depends on the text. |
550 5.7.26 (Gmail), 550 5.7.509 (Microsoft), SPF check failed, DMARC check failed | SPF, DKIM or DMARC isn't set up correctly for your domain. | You: set them up properly, including for services that send mail on your behalf. See What is DMARC? Explanation in plain language. |
550 5.7.25 (Gmail) | The sending server doesn't have a valid reverse DNS (PTR). | The server's administrator: for a hosting package, that's us, for a VPS, that's you (Sending mail from your VPS and setting up reverse DNS). |
421 4.7.28 or 550 5.7.28 (Gmail), unusual rate | Unusually high volume of (unwanted) mail from this IP address. | The server's administrator. If you're sending a lot of mail at once yourself, use a newsletter service. |
451 4.7.500 (Microsoft), Server busy | Microsoft is temporarily throttling the sending server's IP address. | No one directly: the server will retry automatically. |
550 5.7.606 (Microsoft), banned sending IP | Microsoft has blocked the sending server's IP address. | The server's administrator. For our servers: send us the bounce. |
550 5.7.708 (Microsoft) | You're sending via Microsoft 365 and Microsoft is no longer accepting traffic from that environment. | The administrator of your Microsoft 365, via Microsoft support. |
550 5.7.515 (Microsoft) | You're sending a lot of mail to Outlook.com without successful SPF and DKIM, or without DMARC. | You: set up SPF, DKIM and DMARC properly. |
554 IP=... - None/bad reputation (NOWL) (T-Online) | T-Online doesn't allow mail from this IP address. | The server's administrator. Send us the bounce. |
421 Service not available, Too many connections | The receiving server isn't accepting mail right now. | No one: our server will retry later automatically. |
| blocked using, listed at, Spamhaus | An IP address is on a blacklist. | See Sending rejected: blacklists and limits. |
You can read more about Microsoft and T-Online in Mail to Outlook, Hotmail or T-Online delayed or rejected. If your code isn't listed, look it up with the party that issued it, such as Gmail or Microsoft.
Bounces from mail you didn't send
Suddenly getting bounces from mail you never sent? Then take a look at the original mail at the bottom. If your address is listed as the sender, but with text and a server you don't recognize, a spammer has forged your address and the bounces are coming back to you. This is called backscatter. Your mailbox isn't necessarily hacked. A DMARC record helps recipients reject such forged mail, see What is DMARC? Explanation in plain language. To be sure, check your Sent folder and Email Tracing to see if nothing was sent from your own mailbox. If in doubt, read What to do if your email address has been misused.
Can't figure it out? Create a ticket via the Support Center with the full bounce, the recipient's address and the time. Then we can look up the mail right away.
Also see in the DirectAdmin manual: Sending rejected: blacklists and limits.
Detailed explanation with screenshots: I can't send email in the DirectAdmin manual.