Email bounce codes explain why a message wasn't delivered. Codes starting with 4 (such as 421 or 4.7.0) are soft bounces: temporary problems your server retries. Codes starting with 5 (such as 550 or 5.1.1) are hard bounces: permanent failures. The middle digit of the enhanced code gives the category; 5.7.x means a security or policy block.
This guide explains how to read a bounce, the codes you'll meet most often from Gmail and Microsoft, and what to do about each.
Key takeaways
- Codes starting with 4 are soft bounces that your server retries, while codes starting with 5 are permanent hard bounces.
- In the enhanced status code the middle digit gives the category, and 5.7.x means a security or policy block.
- A 550 5.1.1 bounce means the recipient address does not exist, so check for typos and then remove the address.
- Fix 5.7.x authentication bounces through your SPF, DKIM and DMARC records, and remove hard-bounced addresses straight away.
How do I read an email bounce code?
A bounce usually contains two codes side by side, for example 550 5.1.1:
- The basic reply code (
550) comes from the SMTP standard, RFC 5321. The first digit matters most: 2 means success, 4 a temporary failure, 5 a permanent failure. - The enhanced status code (
5.1.1) follows RFC 3463, in the form class.subject.detail. The class repeats the 2/4/5 meaning; the subject tells you where the problem is.
| Subject digit | Meaning (RFC 3463) | Typical cause |
|---|---|---|
| x.0.x | Other or undefined | Catch-all |
| x.1.x | Addressing | Address doesn't exist or is mistyped |
| x.2.x | Mailbox | Full or disabled mailbox |
| x.3.x | Mail system | Receiving system problem |
| x.4.x | Network and routing | DNS or routing failure, timeouts |
| x.5.x | Mail delivery protocol | Protocol errors |
| x.6.x | Message content or media | Message too large or malformed |
| x.7.x | Security or policy | Authentication failure, spam block, blocklist |
The human-readable text after the codes is often the most useful part. Receivers like Gmail and Microsoft add specific explanations and links.
What is the difference between a hard and soft bounce?
| Soft bounce (4xx) | Hard bounce (5xx) | |
|---|---|---|
| Meaning | Temporary: try again later | Permanent: won't succeed as sent |
| Who retries | Your mail server, automatically | Nobody; the message is returned |
| Examples | Rate limiting, full mailbox, greylisting, server busy | Address doesn't exist, domain doesn't exist, policy rejection |
| What to do | Usually nothing; investigate if it repeats | Fix the cause or remove the address |
Your server typically retries soft bounces for several days before giving up. RFC 5321 suggests a give-up time of at least four to five days. Email platforms usually convert an address that soft-bounces repeatedly into a suppressed contact.
What do the most common bounce codes mean?
Address and mailbox problems
- 550 5.1.1 (Gmail: recipient doesn't exist; Microsoft: "Bad destination mailbox address"). Check for typos, then remove the address.
- 550 5.1.10 (Microsoft: "Recipient not found"). Same as above.
- 452 4.2.2 (Gmail: inbox full). Temporary; your server retries.
- 552 5.2.2 (Gmail: inbox full and inactive). Treat as permanent and remove after a few attempts.
- 4.4.7 Message expired (Microsoft). Your server couldn't deliver before the retry period ran out, often a problem on the receiving side.
Authentication failures (the 5.7.x family)
These are the codes that have grown since Gmail, Yahoo and Microsoft began enforcing sender requirements.
| Code | Provider | Meaning |
|---|---|---|
| 550 5.7.26 | Gmail | Unauthenticated, or failed the domain's DMARC policy |
| 421 4.7.27 / 550 5.7.27 | Gmail | SPF didn't pass (bulk sender) |
| 421 4.7.30 / 550 5.7.30 | Gmail | DKIM didn't pass (bulk sender) |
| 421 4.7.40 / 550 5.7.40 | Gmail | No DMARC record or policy |
| 421 4.7.32 | Gmail | From: not aligned with SPF or DKIM domain |
| 451 4.7.23 / 550 5.7.25 | Gmail | Sending IP has no PTR record, or it doesn't match |
| 550 5.7.23 | Microsoft | Rejected because of an SPF violation |
| 550 5.7.509 | Microsoft | Failed DMARC and the domain has p=reject |
| 550 5.7.515 | Outlook.com | High-volume sender doesn't meet the required authentication level |
The fix for all of these is in your DNS and sending platform: SPF, DKIM and DMARC. Our email authentication checklist covers each step, and MakeItFlow's free email deliverability checker shows what's missing.
Reputation, rate limiting and blocks
- 421 4.7.0 (Gmail): a catch-all temporary block, covering low IP or domain reputation, missing PTR records, suspicious content and TLS requirements.
- 421 4.7.28 (Gmail): unusual volume detected, so Gmail is rate limiting you. Google says to stop for at least 10 minutes, then resume from a single connection.
- 450 4.2.1 (Gmail): the recipient is receiving mail too quickly. Slow down.
- 550 5.7.1 (Gmail and Microsoft): a broad policy block. With Gmail it can mean likely unsolicited mail or low reputation; with Microsoft it often means you aren't allowed to send to a group, or relay was denied.
- 550 5.7.606-649 (Microsoft): your sending IP is on Microsoft's blocked senders list. Request removal at sender.office.com.
- 550 5.7.511 (Microsoft): banned sender. Email delist@microsoft.com with the full bounce.
If a bounce mentions a named blocklist such as Spamhaus, check the listing on the list operator's site and fix the cause before requesting removal.
Problems on your own side
- 5.2.2 "Submission quota exceeded" from your own Microsoft 365 tenant means you hit sending limits, and Microsoft warns this can indicate a compromised account.
- 5.7.57 (Microsoft) means an app or printer tried to send through smtp.office365.com without authenticating.
- 5.4.1 "Relay Access Denied" points to MX or DNS misconfiguration on the receiving domain.
How do I fix a 550 bounce?
- Read the full text, not just the number. Receivers usually explain the reason.
- Decide whose problem it is. 5.1.x is usually the recipient address. 5.7.x is usually your authentication or reputation.
- Check your records if it's 5.7.x. Run the free SPF checker and DMARC checker, and confirm DKIM signing is on in every platform.
- Send a test to Gmail and Outlook.com addresses and check the headers for
spf=pass,dkim=passanddmarc=pass. - Clean your list. Remove hard-bounced addresses immediately; repeatedly mailing them damages your reputation. Before importing new addresses, an email verifier catches typos, domains with no mail server and disposable addresses.
MakeItFlow scans your domain's MX, SPF, DKIM, DMARC and related records in one go. Run a free website audit to rule out DNS problems before digging into individual bounces.
Frequently asked questions
Should I keep emailing addresses that hard bounce?
No. Remove them straight away. Microsoft's Outlook.com postmaster policy says senders must not retransmit a message after a 5xx error and must stop mailing a recipient after repeated non-delivery responses. Repeated sends to dead addresses look like poor list hygiene to every provider.
Why did I get a bounce days after sending?
That's usually a soft bounce that turned permanent. Your server kept retrying a 4xx error, then gave up and returned the message once its retry period ended, typically after several days.
Is a 4.7.x code a warning I should act on?
Yes, even though it's temporary. Gmail now uses 4.7.x codes such as 4.7.27, 4.7.30 and 4.7.40 to rate limit senders failing authentication. If they keep appearing, the same messages may later be rejected with 5.7.x codes.
What does "mailbox unavailable" mean?
It's a common wording of 550 and usually means the address doesn't exist or the account is disabled. Occasionally receivers use it to hide a policy block, so read any extra text in the bounce.
Do bounce codes differ between providers?
The basic and enhanced codes are standard, but each provider adds its own detail and uses some codes differently. Microsoft, for example, uses ranges like 5.7.606-649 for its own blocked senders list. Always check the provider's own documentation.
What to do next
Export the bounce reports from your email platform for the last month and group them by code. Remove 5.1.x addresses, and if 5.7.x codes appear, fix authentication before your next campaign. Our guide to Gmail, Yahoo and Microsoft sender requirements explains the rules behind the newer codes.
Related reading
- DMARC Fail: What It Means and How to Fix It Quickly: DMARC fail means neither SPF nor DKIM passed for a domain matching your From address. Learn how to read the headers, find the cause and fix it safely.
- How to Use Google Postmaster Tools (2026 Guide): How to use Google Postmaster Tools: verify your domain, read the compliance, spam rate and delivery error dashboards, and act on what they show in 2026.
- Why Do My Emails Go to the Gmail Promotions Tab?: Emails landing in Gmail's Promotions tab? Learn why Gmail sorts mail this way, why it isn't spam, and practical steps to reach Primary more often.
Sources
- RFC 3463: Enhanced Mail System Status Codes
- Google Workspace Admin Help: Gmail SMTP errors and codes
- Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online
- Microsoft Learn: Remove yourself from the blocked senders list
- Microsoft Outlook.com Postmaster: Policies, practices and guidelines
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 30 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
