Reading a Bounce Message: SMTP Codes and NDRs Explained

A bounce, formally a non-delivery report, is the most direct feedback you'll get on why a message failed. Most people read the first few words and give up. The structure is simple once you know where to look, and the useful part is usually at the end.

Three layers in one message

• The reply code: three digits such as 550 or 421. The first digit is the verdict. 2xx means accepted, 4xx means a temporary failure and the sender should retry, 5xx means permanent and the sender shouldn't
• The enhanced status code: three numbers such as 5.1.1 or 5.7.26. The first repeats the verdict. The second is the subject: 1 the address, 2 the mailbox, 4 the network, 7 security and policy. The third is the specific detail
• The text: a human-readable explanation, often with a URL. It names the actual reason and is where a blocklist, a failed authentication check or a rate limit is identified

A bounce email, with the Diagnostic-Code line, the Action: failed line and the quoted original headers, carries these three layers plus the name of the server that refused the message. That server name tells you who objected: the recipient's mailbox provider, or a security gateway in front of it.

The ones you'll see most

• 5.1.1: the recipient doesn't exist. Remove the address
• 5.7.1: refused for policy, the generic security rejection. Read the text for the blocklist, authentication or reputation reason
• 5.7.26 at Gmail: the message failed authentication. Check SPF, DKIM and alignment
• 421 and 4.7.0: deferred, usually rate limiting or reputation. Slow down and let the queue retry
• 5.2.2: the mailbox is full. Not your problem, and not worth repeated retries

Hard and soft

A 5xx is a hard bounce and a 4xx is a soft one. A soft bounce that keeps returning from the same provider, though, isn't a series of coincidences. It's that provider telling you your volume or reputation is the problem, and the right response is to send less, not to retry harder.

What to do with a bounce

• Keep the whole message, not just the code. The explanation text is what separates two very different problems with the same number
• Decode it, and check whatever it names: an IP or domain in the text can be looked up on blocklists directly
• Act on the class: remove dead addresses, fix authentication, reduce rate, or investigate reputation
• Don't retry permanent failures, and don't resend by hand over the queue's own retries

Paste a bounce and get the meaning, the cause and the fix

5.1.1: recipient doesn't exist

5.7.1: refused for policy

Gmail 5.7.26: failed authentication

What 421 and 450 are telling you

The code tells you the class of problem. The sentence after it tells you the problem.