In this guide · 8 sections
Short answer
Find the three-part code in the bounce, such as 5.1.1 or 5.7.26. Codes starting with 4 are temporary and usually retry; codes starting with 5 are permanent. 5.1.x means a wrong address, 5.2.2 a full mailbox, and 5.7.x usually a block or failed SPF, DKIM or DMARC check.
How to read a bounce-back message
Open the bounce and look for two things: the status code (three numbers separated by dots, such as 5.7.1) and the server text next to it. The first digit tells you the type of problem, as Microsoft explains in its guide to non-delivery reports in Exchange Online:
- 4.x.x: temporary. The sending server will usually keep retrying for a while. Wait, then resend only if a final failure arrives.
- 5.x.x: permanent. The message was rejected. Resending the same message will fail again until the cause is fixed.
The bounce also shows which server rejected it. If it names the recipient's server, the problem is usually on their side or with how they see your domain. If it names your own provider, look at your account or domain first.
Common bounce-back codes decoded
Codes and meanings from Microsoft's NDR reference and Google's Gmail SMTP error list, simplified:
| Code | What it means | Who fixes it | What to do |
|---|---|---|---|
| 5.1.1 / 5.1.10 | Recipient address doesn't exist | You | Check the spelling; ask for the correct address |
| 5.2.1 | Recipient's account is inactive or disabled (Gmail) | Recipient | Contact them another way |
| 5.2.2 / 4.2.2 | Recipient's mailbox is full | Recipient | Tell them by phone or WhatsApp; resend later |
| 5.1.8 / 5.7.501-503 | Your account was blocked for sending spam (Microsoft 365) | You | Treat as a possible hack; secure the account first |
| 5.1.90 / 5.2.2 (Microsoft) | You hit a sending limit | You | Spread sends out or use a marketing tool for bulk mail |
| 5.7.1 Delivery not authorized | Recipient doesn't accept your mail (often external or group restrictions) | Recipient's admin | Ask them to allow your address or domain |
| 5.7.1 blocked using Blocklist | Your sending IP is on Microsoft's blocklist | You or your provider | Follow the delisting steps in the bounce |
| 5.7.23 / 5.7.27 | Your message failed SPF | You | Fix your SPF record |
| 5.7.26 (Gmail) | Unauthenticated: failed SPF and DKIM, or your DMARC policy | You | Set up SPF and DKIM; check DMARC |
| 5.7.509 (Microsoft) | Your domain fails DMARC with a reject policy | You | Fix SPF/DKIM alignment before keeping p=reject |
When the problem is your own domain: SPF, DKIM and DMARC
If many recipients bounce your mail with 5.7.23, 5.7.26, 5.7.27 or 5.7.509, the problem is almost certainly how your domain is set up. Receiving servers check that mail claiming to be from your domain is allowed to be sent by the server it came from (SPF) and is digitally signed (DKIM). DMARC tells them what to do when both checks fail.
Gmail now rejects or rate-limits mail that fails these checks: its error 5.7.26 says Gmail 'requires all senders to authenticate with either SPF or DKIM'. Common causes in small businesses are a new email service, website form or marketing tool that was never added to the SPF record, two SPF records on the same domain, or a DMARC policy set to reject before DKIM was working.
Our SPF, DKIM and DMARC guide walks through the records. If the trouble started right after you pointed your domain at a new website, see our guide to connecting a domain without breaking email.
When your own account has been blocked
Microsoft's codes 5.1.8 ('bad outbound sender') and 5.7.501 to 5.7.503 ('banned sender') mean the sending account was blocked for spam. Microsoft notes that this typically happens because the account was compromised by phishing or malware. Sending-limit errors can also be a sign of a hacked account sending spam.
Our guide to what to do when business email is hacked has the full checklist.
A quick check routine for any bounce
Bounce troubleshooting
For newsletters and promotions, a dedicated tool handles bounces, unsubscribes and sending limits for you; our Mailchimp vs Brevo vs Klaviyo comparison covers the options.
Do it yourself or get help?
One bounce to one address is usually a typo or a full mailbox, and you can sort it with a phone call. Bounces from many recipients, especially Gmail and Outlook users, usually mean a domain set-up problem that keeps getting worse until it is fixed.
Our Emails Land in Spam Fix (S$249, with 14 days of monitoring) checks and corrects SPF, DKIM and DMARC across every service that sends as your domain. If your DNS records are messy after a website or provider change, Domain & DNS Setup (S$99) tidies them up. If you are setting up email for the first time, see our business email set-up guide.
Frequently asked questions
It means the receiving system did not authorise delivery. Microsoft lists causes such as the recipient or group rejecting outside senders, a server refusing to relay your message, or mail routed to the wrong server. The server text after the code tells you which. Often only the recipient's email admin can fix it.
Gmail uses 5.7.26 when a message fails authentication: neither SPF nor DKIM passed, or your domain's DMARC policy told Gmail to reject it. Google requires all senders to authenticate with SPF or DKIM. Check that every service sending as your domain is included in SPF and signs with DKIM.
A soft bounce is temporary, shown by a code starting with 4, such as a busy server or a temporarily full mailbox, and the sending server usually retries. A hard bounce starts with 5 and means the message was permanently rejected, for example because the address does not exist or the sender is blocked.
5.1.1 means the recipient's address does not exist on the receiving server. The most common causes are a typo, an old address for someone who has left the company, or a domain the recipient no longer uses. Check the spelling and ask the recipient for their current address.
Codes such as 5.1.8 or 5.7.501 mean Microsoft blocked the account for spam, which Microsoft says usually follows a compromise. Change the password, turn on multi-factor authentication, remove unknown inbox rules and check sign-ins first. Only then should a Microsoft 365 admin remove the sending restriction.