Email rejection error codes tell you exactly why a message bounced, if you know how to read them. Find the code in your bounce below, open its guide, and you'll get the fix first, then the reason. Most of these come down to one of three things: your domain's authentication records, your sending IP's reputation, or a setting on the recipient's side.
How do I read an email rejection code?
You read an email rejection code from left to right: the first digit says whether to wait or act, and the rest says why. Under the SMTP status code standard, RFC 3463, a code starting with 4 is a temporary failure that your server retries, and a code starting with 5 is permanent. So 421 means "try again later" and 550 means "this message is dead." The middle part, 5.7.x, is the security and policy family. The last number is the specific reason, and the words after it matter just as much. Microsoft's NDR reference for Exchange Online and Google's Gmail SMTP error reference list the full text for each one.
The fastest way to read a bounce is to paste the whole thing into the free bounce reader at postmortem.report. It runs in your browser, so nothing gets uploaded, and it names the error, says who has to fix it, and gives the fix in one line. Then come back here for the full guide.
Which Microsoft 365 and Outlook codes have a guide?
These Microsoft codes come from Outlook.com, Hotmail and Microsoft 365 servers:
- 550 5.7.515: your domain doesn't meet Outlook's authentication level for high-volume senders. Add SPF, DKIM and DMARC.
- 550 5.7.509: your domain is set to DMARC reject and this message failed. Find the tool that isn't aligned and fix its SPF or DKIM.
- 550 5.7.1: a security or policy setting stopped the message. The words after the code (unable to relay, delivery not authorized, blocklist) tell you which fix you need.
- 550 5.7.606 and 5.7.708: Microsoft blocked the IP you send from, or your own tenant. Delist a 5.7.606 IP at sender.office.com; a 5.7.708 or 5.7.705 block needs Microsoft support after you fix the cause.
- 550 5.7.23: the receiving server's SPF check failed. Merge into one SPF record that lists every sender and stays under 10 lookups.
Which Gmail codes have a guide?
This Gmail code comes from Google's servers, for both Gmail and Google Workspace recipients:
- 550 5.7.26: Gmail couldn't authenticate your message with SPF, DKIM or DMARC. Match the bounce text to the record that failed.
Why do so many bounces come back to authentication?
So many bounces come back to authentication because the big inbox providers now require it, and many domains haven't finished setting it up. Google's sender guidelines ask every sender for SPF or DKIM, and Microsoft enforces its own rules for high-volume senders. The gap is wide in Southwest Michigan. When I checked local businesses' email settings, I found that 79.2% of 847 businesses that email from their own domain (1,527 checked) have no DMARC enforcement. The Southwest Michigan Email Security Report covers 11 counties and breaks the numbers down by county and email provider.
What should I do if my code isn't listed?
If your code isn't listed, start with the words after the number and the free bounce reader at postmortem.report, which covers far more codes than these guides. If the bounce names SPF, DKIM, DMARC or "unauthenticated," the fix is in your domain's DNS. Check where you stand in about 30 seconds with the free email security check.
If you run a business in Battle Creek, Kalamazoo or anywhere in Southwest Michigan and want the bouncing to stop for good, my DMARC audit service finds every tool that sends as your domain, sets up SPF, DKIM and DMARC across them, and rolls protection out step by step so nothing breaks. Call me at (269) 460-1772 or use the contact form and tell me what the bounce says.