When an email can't be delivered, the sending mail server sends a bounce message (technically a Non-Delivery Report, or NDR) back to the sender. Bounces look intimidating — lots of headers, error codes, and jargon — but they almost always tell you exactly what went wrong, if you know where to look.
Anatomy of a bounce message
A typical bounce from our servers looks like this:
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its recipients.
This is a permanent error. The following address(es) failed:
[email protected]
host mx.example.com [192.0.2.10]
SMTP error from remote mail server after RCPT TO:<[email protected]>:
550 5.1.1 <[email protected]>: Recipient address rejected: User unknown
------ This is a copy of the message, including all the headers. ------The two pieces you care about:
- The failing address — who it was for. Here:
[email protected]. - The SMTP error line — the status code and the human-readable reason, sent back by the receiving mail server. Here:
550 5.1.1 ... User unknown.
Decoding the status code
SMTP status codes are three digits. The first digit tells you broadly what happened:
- 5xx — permanent failure (hard bounce). The message will not be delivered. Retrying won't help. Fix the underlying issue before retrying.
- 4xx — temporary failure (soft bounce). Our server will retry automatically for up to 4–5 days. If those retries fail too, it becomes a hard bounce and you get a final NDR.
The text after the code is where the real diagnosis lives. Here are the codes you'll most commonly see.
550 — permanent rejection (the most common bounce)
This is a catch-all rejection code that means "I refuse to accept this message." The text after it explains why.
| What the text says | What it means | How to fix |
|---|---|---|
550 No such user / User unknown / Recipient address rejected |
The recipient's email address doesn't exist. Usually a typo. | Check the spelling. Ask the recipient for their correct address. |
550 5.7.1 Mailbox quota exceeded / Mailbox full |
The recipient's mailbox is full. | Contact the recipient by another channel (phone, text) so they can clear space. |
550 Message rejected as spam / High spam score |
The receiving server's spam filter rejected the message. | Reduce spam triggers (shorter subject, fewer links, no link shorteners, no all-caps). If you're a legitimate sender, check that your SPF / DKIM / DMARC records are configured — this is the #1 cause of deliverability issues. See Set up SPF, DKIM, and DMARC. |
550 5.7.1 Access denied, sending domain not authorized / SPF check failed |
The receiver checked the sender domain's SPF record and your sending server wasn't authorized. | Make sure your domain's SPF record is set up and includes our servers. See Set up SPF, DKIM, and DMARC. |
550 5.7.1 Your IP is blacklisted / blocked using ... |
Your sending server's IP is on a blocklist. Rare on our servers (we actively manage this) but possible. | Open a support ticket. We'll investigate and request delisting if needed. |
550 5.7.509 Access denied, sending domain [...] does not pass DMARC verification |
The receiver enforces DMARC and your message failed both SPF and DKIM alignment. | Check your DMARC policy (usually p=none or p=quarantine) and SPF/DKIM setup. See Set up SPF, DKIM, and DMARC. |
554 — transaction failed (policy rejection)
Similar to 550, but used when the receiver rejected the message based on a policy rather than the recipient address itself.
| What the text says | What it means | How to fix |
|---|---|---|
554 5.7.1 [...] Relay access denied |
You're trying to send mail through a server that doesn't allow it — usually means SMTP authentication failed. | In your mail client's outgoing server settings, make sure authentication is enabled and the username/password matches your mailbox. See the setup guide for your mail client. |
554 Message rejected by content filter |
The receiver's content filter (antivirus, DLP, custom rules) rejected the message. | Check for attachments the receiver may block (.exe, .zip, encrypted archives, macros). Ask the recipient if IT has rules against certain file types. |
4xx — temporary failures
These are "try again later" errors. Our servers retry automatically, so you usually don't need to do anything. You'll only see a bounce if retries keep failing for several days.
| What the text says | What it means |
|---|---|
450 / 451 Greylisted, try again later |
The receiver is using greylisting — a spam-prevention technique that asks every new sender to retry. Our servers retry automatically. Usually delivered within 5–15 minutes. |
421 4.7.0 Too many connections |
The receiving server is under load. Our server will retry. |
450 4.1.1 Mailbox busy |
The recipient's mailbox is temporarily locked (often during IMAP sync). Retry usually succeeds. |
Enhanced status codes (the 5.x.x numbers)
The extra code after the main 3-digit code (e.g. 5.1.1, 5.7.1, 5.4.1) is an enhanced status code that adds specificity. A few common ones:
5.1.1— recipient address doesn't exist5.1.2— recipient's domain doesn't exist (typo in the part after the @)5.2.2— mailbox full5.4.1— recipient's mail server not responding5.4.4— can't resolve recipient's domain (DNS problem)5.7.1— blocked by policy (SPF/DMARC/blocklist)5.7.26— failed DMARC alignment
Common bounce scenarios
"The message was rejected by the receiver for policy reasons"
Typically a 5.7.x DMARC or SPF rejection. Your sending domain isn't properly set up to authenticate outgoing mail. See Set up SPF, DKIM, and DMARC for your domain — cPanel will configure everything for you in one click on our servers.
"Bounced to my own mailbox right after I sent it"
This is usually an address-not-found error (550 5.1.1). Double-check the recipient address for typos. Common culprits: .con instead of .com, gmial.com instead of gmail.com, a missing dot, or a space you didn't notice.
"Bounce says my IP is blacklisted"
Possible but rare. Open a support ticket with the full bounce message and we'll check our server's reputation. If a listing is legitimate, we request delisting — usually cleared within a few hours.
"Bounce says authentication failed (RCPT TO rejected with 554 relay access denied)"
This is almost always a misconfigured outgoing SMTP server in your mail client. The client is trying to send without authenticating. Check your outgoing server settings and confirm SMTP authentication is enabled with your full email address as the username.
"I only get bounces when sending to [one provider]"
Usually means that provider is treating your domain with extra scrutiny. The most common fix is to make sure your SPF, DKIM, and DMARC are all set up — most major providers (Gmail, Outlook, Yahoo) require all three since Feb 2024 for senders of any volume. See Set up SPF, DKIM, and DMARC.
What to do with a bounce you can't decipher
If the error text is cryptic or contradictory, and you've checked the obvious things (spelling, quota, authentication), open a support ticket and include the full bounce message, especially the host, SMTP error, and headers sections. We deal with these daily and can usually identify the issue quickly.
Related articles
- Set up SPF, DKIM, and DMARC for your domain
- Email troubleshooting checklist
- Set up Google Workspace MX records on CanSpace
- Set up Microsoft 365 MX records on CanSpace
Still stuck? Open a support ticket
