How to read a bounce-back
The bounce usually arrives from “Mail Delivery Subsystem”, “Microsoft Outlook” or “postmaster”. Near the top it says who
the message could not be delivered to. Further down — sometimes under “Diagnostic information” or “Technical details” —
is the line that matters: the server that refused it, and a code such as 550 5.1.1 followed by a short
reason.
- The first digit of the enhanced code is the severity: 5 is a permanent failure, 4 is temporary.
- The second is the category: 1 is the address, 2 the mailbox, 3 the mail system, 4 the network or routing, 7 security and policy.
- The server name tells you whose system refused it — the recipient’s, or your own.
Common bounce codes and what to do
| Code | What it means | What to do |
|---|---|---|
| 5.1.1 (550) | The address does not exist at that domain. | Check the spelling. If it is right, the person may have left — phone to get a current address. |
| 5.1.10 | Microsoft 365’s version of “recipient not found”. | As above. Remove any old, wrong entry from your autocomplete list. |
| 5.2.2 (552) | From most servers, including Gmail: the recipient’s mailbox is full. From Microsoft 365: you have hit Microsoft’s limit on how many messages or recipients you can send to. | If their mailbox is full, wait or contact them another way. If it is a Microsoft sending limit, wait 24 hours, and check your account has not been used to send spam. |
| 5.3.4 (552) | The message is too large for the receiving system. | Send the file by a sharing link instead of an attachment. |
| 5.7.1 (550) | Rejected by the receiving server’s policy: blocked sender, not allowed to send to that address, or spam filtering. | Read the text after the code. If it mentions a blocklist, see below; otherwise ask the recipient to check their filtering. |
| 5.7.23 / 5.7.26 | Failed sender authentication — SPF (Microsoft’s 5.7.23) or DMARC/unauthenticated mail (Gmail’s 5.7.26). | Your domain’s records need fixing. Check them with our email security checker. |
| 4.x.x (421, 450, 451, 452) | A temporary problem: the server is busy, greylisting you, or the mailbox is temporarily over quota. | Nothing, usually. Your server retries for a day or more before giving up. |
When the bounce mentions a blocklist
Messages such as “blocked using” followed by a list name mean the server that sent your mail — or your domain — is on a spam blocklist. On Microsoft 365 or Google Workspace, that is usually a shared server and the provider deals with it; report it to them. If you run your own server, or use basic hosting email, the blocklist’s website explains how to request removal once the cause (often a compromised account sending spam) is fixed.
When lots of your emails bounce
If messages to many different organisations are bouncing with 5.7.x codes, the problem is on your side. The usual causes are a missing or broken SPF record after a change of provider, DKIM not set up, or a strict DMARC policy that your own sending service fails. Check your domain with the SPF checker and DMARC checker, then paste a bounced message’s headers into the email header analyser.
Bounces for emails you never sent
A flood of bounce-backs for messages you did not write means someone is sending spam that pretends to come from your address, and the bounces are coming back to you. Your account has probably not been hacked — but check for unknown rules and change your password to be sure. The lasting fix is a DMARC policy of quarantine or reject, which tells receiving servers to refuse forged mail. Our guide to SPF, DKIM and DMARC explains how to get there safely.