Why was my email rejected during SMTP?

An SMTP rejection is the receiving server’s explanation for refusing a delivery attempt. The full response tells you more than the error number alone.

MXroute can reject mail because of a sending limit, an invalid address, a server configuration problem, an authentication failure, or an anti-abuse policy. This guide covers errors returned by MXroute while another server delivers mail to an MXroute recipient, or while an MXroute customer submits outgoing mail.

If a bounce quotes an error from a different provider, use that provider’s response to investigate. A bounce delivered through MXroute is not necessarily a rejection issued by MXroute.

Rejected mail

A rejected message was not accepted for that delivery. It is not waiting in the recipient’s Spam folder, and there is no mailbox copy to release. Once the cause is resolved, the sender may need to send it again.

Start with the full error

1. Copy the complete response. Keep the SMTP code, the text after it, the rejecting server, and the date and time with timezone.
2. Identify the delivery path. Were you sending through MXroute, or was someone at another provider sending to your MXroute mailbox?
3. Find the matching wording below. A bare “550” or “Message rejected” is not enough to identify every cause.

Response	What happens next
4xx, such as 451	A temporary failure. A sending mail server normally keeps the message queued and retries later. An application that submits mail directly may instead show an error.
5xx, such as 550 or 554	A permanent failure for that attempt. Do not expect automatic redelivery. Correct the cause before resending.

“Permanent” describes the SMTP result, not how long a restriction lasts. A rate limit or temporary IP block can still return a 5xx response. Some rejections also close the connection. The retry distinction follows SMTP reply-code semantics.

Which sender address does the error mean?

The envelope sender is the address your application or mail server supplies in MAIL FROM. It can differ from the From header displayed in an email. Changing the visible From field may leave the envelope sender unchanged.

The SMTP login identifies the mailbox submitting mail. HELO/EHLO is the sending server’s introduction. A message can pass one check and fail another; an SMTP login does not bypass every policy.

Servers delivering ordinary incoming mail usually do not log in to the recipient’s mailbox. In these explanations, “unauthenticated” describes that SMTP session; it does not, by itself, mean the message failed SPF, DKIM, or DMARC.

Find the reason for your rejection

Expand a category to see the response wording, or use the site search to find an error. Values in square brackets stand for the address, IP, login, or score in your actual error. Active rules, exceptions, and exact wording can vary between servers.

SMTP login and permission to send

These errors can mean your application has not logged in, the server does not receive mail for the destination, or your login is restricted to particular sender identities.

If you are sending through MXroute: check the outgoing server, SMTP authentication, and full mailbox login in your application. Check both its envelope sender and its visible From address. Email client settings can help. If another provider is delivering to you: check that your domain is on the correct MXroute server and is configured to receive mail here. The other provider does not need your mailbox password to deliver ordinary incoming mail.

Error messages and what they mean

550 Relay not permitted

The session has not authenticated and the recipient domain is not configured as local on this server. For incoming mail, a wrong MX destination or disabled local routing can produce this error. For outgoing mail, the application may not have authenticated.

550 Envelope sender [sender address] is not permitted for your login [login]
550 From header is not permitted for your login [login]

You are trying to spoof your sender address by using an envelope sender or From address that does not match the mailbox you logged in as. Use your logged-in address, or enable Alias Sending to send from another address at the same domain. You can enable this yourself in the Control Panel. The setting applies to every mailbox on the selected domain and does not authorize sending from other domains.

Sending limits

The hourly sending limit is tied to the authenticated mailbox login. Changing the visible From address does not change that login’s limit.

Pause the sending job and reduce its rate. This is a smoothed rate, so there is no promised reset at the start of the next clock hour. Repeated attempts while over the limit continue to count. Although the condition can clear with time, this response is a permanent 550; the rejected message may need to be sent again after the rate has fallen. See Service Limits.

Error messages and what they mean

550 Rate limit exceeded: 400 messages per hour for [login]

The login has exceeded the configured rate of 400 messages per hour. A separate account-level limit may return different wording.

Invalid addresses, test domains, and full mailboxes

Applications need real sender and recipient addresses. A sample configuration, internal hostname, or placeholder address can be rejected before the message is accepted.

Check the application’s envelope sender and the complete recipient address. Replace template values with valid addresses you are authorized to use. Test with a real mailbox you control. For the manual quota rejection below, the recipient needs to clean up and maintain the affected mailbox; see Understanding Disk Usage.

Error messages and what they mean

550 Your software claims your sending address is on example.com which is not your domain

The envelope sender uses example.com, a documentation placeholder.

550 Sending to domains starting with "example.com" is not allowed.
550 Stop asking AI agents to flood our queues with fake emails to fake domains, our systems are for production, they are not your garbage recepticle
550 Sending to .local TLD is not allowed (reserved for mDNS per RFC 6762)
550 Sending to email.tst domains is not allowed

The recipient matches a restricted example.com or email.tst pattern, or uses a domain ending in .test or .local. These checks can also match longer names beginning with the restricted patterns.

550 Recipient domain must be a fully qualified name
550 Envelope sender domain must be a fully qualified name

The recipient or envelope sender has a nonempty domain with no dot, such as a machine’s local hostname.

550 Please use a real sending domain

The envelope sender domain ends in cloudwaysapps.com. Configure the application with your own valid sending domain.

550 Your recipient has reached their disk quota

This is a manual rejection applied by MXroute staff, typically to a mailbox that has been left full and unattended while continuing to receive a very large volume of mail. Rejecting that traffic during SMTP reduces load on the IMAP server, which currently checks and enforces disk quotas. The recipient must clean up the mailbox and address its ongoing maintenance. Clearing space alone does not remove this staff-applied block; the account owner can request its removal after resolving the problem.

SPF, DMARC, and protected sender domains

SMTP login and domain authentication are different checks. SPF evaluates whether the connecting server may use the envelope sender domain. DMARC evaluates authentication in relation to the visible From domain. We do not issue SPF or DMARC policy rejections because a DNS lookup failed. These rejections follow successful DNS lookups whose returned records do not approve the message.

The sending domain’s administrator or sending provider should investigate these errors. Check the actual sending service and its DNS authentication setup. If forwarding is involved, include that in the investigation. MXroute customers can use the SPF, DKIM, and DMARC guides for their own domains.

Error messages and what they mean

550 SPF check failed. [sending IP] is not authorized to send mail from [sender domain or HELO]

The sender’s SPF result was a hard failure for an unauthenticated connection. The response identifies the connecting IP and the envelope sender domain, or HELO name for an empty envelope sender. This particular rejection does not mean SPF was merely missing or returned softfail.

550 Rejected per sender domain DMARC policy

The message reached a DMARC rejection decision under the sending domain’s policy. The sender’s administrator should check SPF/DKIM alignment with the visible From domain. This message alone does not identify which authentication component failed.

550 Mail from email.cz is only accepted from authorized IP ranges
550 Mail from gmail.com is only accepted from authorized IP ranges
550 Mail from sent.com is only accepted from authorized IP ranges

The message claimed an envelope sender at email.cz, gmail.com, or sent.com, but connected from outside the IP ranges allowed by MXroute for that domain. We apply these restrictions to domains that spammers impersonate constantly and whose weak SPF policies do not adequately prevent that abuse. These are additional provider-specific protections, separate from the SPF hard-failure check. Send using the provider’s authorized mail service.

550 Suspected PayPal spoofing attempt blocked

A paypal.com envelope sender arrived with an Outlook-related HELO or resolved hostname that matched an anti-spoofing rule. A legitimate sender’s provider should supply the full delivery evidence for review.

Sending server names and network restrictions

A sending server introduces itself using HELO or EHLO. Some checks examine that name; others examine the server’s resolved hostname or connecting network. An error mentioning a computer does not necessarily identify the sender’s personal device.

The sending server’s operator should check its HELO/EHLO name and reverse DNS. A legitimate mail server should use an appropriate hostname under its operator’s control. Give your provider the exact response and sending IP; an MXroute recipient usually cannot correct another provider’s server configuration.

Error messages and what they mean

550 Suspicious HELO rejected

The HELO name matched a blocked prefix associated with a suspicious sending pattern.

550 This computer has been blocked from sending email

The HELO name matched a blocked suffix or an entry on the HELO blocklist. The blocklist form also closes the connection.

550 Rejected: HELO/EHLO name is a default OVH reverse DNS
550 Mail not accepted from default assigned hostnames

The HELO name, or for the VPS rule the resolved hostname, matched a default OVH naming pattern. This does not mean every OVH-hosted server is rejected.

550 Blocked HELO - Suspicious domain

The HELO name matched a restricted .xmail.ntesmail.com suffix.

550 This message represents a spam trend that matches no non-spam senders

An unauthenticated connection used a HELO name ending in .solutions and did not match the rule’s host exception. When was the last time you visited a legitimate .solutions domain? Exactly.

550 Google Cloud has conditional access to our SMTP

Google Cloud servers are spam cannons. A server there that has not been properly configured for email provides strong evidence that it is being used by a spammer. The sending server’s operator needs to configure it properly before attempting delivery.

550 Suspicious email trend detected and blocked.

An unauthenticated connection matched a combination of an OVH network and a numbered mail-host naming pattern, without the applicable host exception.

550 Intentionally vague error message requiring you to contact support

A server-name policy check requires staff review. Include the exact HELO/EHLO name, connecting IP, recipient, and time. The wording is intentionally nonspecific; it does not establish an account suspension.

Expert Spam Filtering

Expert Spam Filtering can reject unauthenticated delivery from suspicious IP ranges to protected recipient domains.

For legitimate mail arriving from another mail server: use the whitelist-request process in Expert Spam Filtering and include the sending IP and domain. For your own application sending through MXroute: verify that it actually authenticated. Adding a sender to the Control Panel’s trusted-sender list is not a replacement for this process.

Error messages and what they mean

550 Unauthenticated mail not allowed from this range to protected domain, nonspam senders request whitelisting at esf.mxroute.com

The connecting network is restricted for the recipient domain, and the relevant host or sender-domain exception did not apply. The response points legitimate senders to esf.mxroute.com.

Addresses or accounts blocked by administrators

Server-level blocks can apply to senders, recipients, or authenticated accounts. They are separate from the trusted and blocked sender entries a customer manages in the Control Panel.

Review Address Blocked by Admins. Resolve the underlying issue and ask support to review the block, including what happened and what you changed. A customer whitelist entry does not remove an administrative block.

Error messages and what they mean

550 Your sending address has been blocked by admins see mxroutedocs.com for explanation
550 Your recipient address has been blocked by admins see mxroutedocs.com for explanation

The envelope sender or recipient matched an administrator-maintained blocklist. A match may cover an address pattern or a domain, not just one exact mailbox. Other account-level blocks may use different response text.

Sender patterns and provider-specific policies

Some SMTP rejections match a sender address, domain, or service pattern associated with abuse. The response may be brief. It does not necessarily mean the server read and scored the message body.

The sending provider should check the envelope sender actually used and follow the correction described below. Use a real sending account and configure your own sending domain where the provider supports it. Exceptions are specific to the matching rule; there is no single whitelist that overrides all of these checks.

Error messages and what they mean

550 Likely spam rejected

This relates to a spammer who creates new Gmail accounts every few minutes to spam our customers.

550 Message rejected

This wording is shared by several checks: certain Outlook/Hotmail address patterns, .dpdns.org subdomains in the sender or server identity, brand-themed sender-address patterns, and a subject pattern involving hidden Unicode characters. The SMTP stage and full delivery details are needed to identify which one matched.

550 Yeah no

An unauthenticated envelope sender used a .bond or .space domain without the rule’s domain exception. Legitimate senders using these domain endings are rare; spam domains using them are overwhelmingly common.

550 Envelope sender domain not permitted

The envelope sender used firebaseapp.com or one of its subdomains without the relevant address exception. Configure your application to send from a real email address that you are authorized to use.

550 Sender address not accepted

The envelope sender’s local part matched a retail-brand pattern outside the rule’s exempt sender domains. This check concerns the address, not the display name alone.

550 Go away

The envelope sender domain matched a dreamhostps.com substring or a documento… .sbs pattern. These different checks share the same response.

550 Blocking non-whitelisted messages from Google Groups

This blocks email from Google Groups on Google Workspace accounts that have not been whitelisted. Spammers creatively abuse these groups to send unsolicited mail to our customers, so this traffic requires a whitelist exception.

550 Suspicious message pattern rejected

The envelope sender matched a more specific as-digit-plus-bnc address pattern at an .info domain. A Google Groups exception does not bypass this separate rule.

550 Sender domain blocked

The envelope sender used a subdomain of secure.ne.jp.

550 Envelope sender containing onmicrosoft.com is not allowed

Use a real email account on your Office 365 subscription with your own domain as the sending address. Legitimate senders rarely use onmicrosoft.com addresses for this purpose; spammers use them frequently.

550 Sendgrid.net sender domains are only allowed to specific whitelisted recipients

Legitimate SendGrid customers normally configure their own envelope sender domain. Very few professional customers leave the shared sendgrid.net domain in place, while spammers use it liberally. Configure a custom envelope sender domain with SendGrid before sending.

Cold email and warmup activity

MXroute prohibits cold email and spam warmup activity. Some errors name that policy directly; others use blunt wording for a blocked sender-domain pattern.

Stop prohibited activity. Do not rotate accounts, domains, or subjects to get around a rejection. See Marketing Email Policy.

Error messages and what they mean

550 Your spam startup has been denied try getting a real job

Face it, you’re a spammer. You know it. I know it. Everyone knows it.

550 Get fucked spammer

The error describes the problem and how you should address it.

550 Go fuck yourself spammer

The error describes the problem and how you should address it.

550 The use of instantly.ai is forbidden as is all cold email, please halt this activity immediately

An authenticated message’s subject contained the account-status test phrase associated with this rule. The response does not prove an instantly.ai integration was detected.

550 Logged for review as likely involved with spam warmup service

Where this optional rule is installed, the sender matched a warmup-related blocklist. Despite “Logged for review”, the message was rejected.

Subject lines and automated messages

A message can be rejected after its body has been transmitted. Some rules check a subject or an automated-message pattern rather than a general spam score.

For legitimate application mail, correct leftover template values or an incorrectly empty envelope sender. Review the specific subject and automated-message restrictions below. Changing a message solely to evade a policy restriction is not a remedy.

Error messages and what they mean

550 This message has been rejected as spam

The message used an empty envelope sender, but its subject did not match the recognized bounce, notification, or auto-reply patterns. Empty senders have a legitimate role in delivery notifications; this is not a ban on all mail with an empty sender.

550 Emails from doclist.bounces.google.com containing emoji in the subject are not allowed

A message from doclist.bounces.google.com contained a four-byte Unicode character in the subject. The response calls these emoji, but the check can include other characters too.

550 Emails with "Support Ticket Not Opened" in the subject are not allowed

The subject contained “Support Ticket Not Opened”, regardless of capitalization.

You’re welcome, WHMCS users.

550 Messages from promote.weebly.com are heavily filtered due to spam

A message from promote.weebly.com did not match the rule’s order-related subject exception.

550 Authenticated users are not allowed to send bounce emails

An authenticated submission had a subject containing “mail delivery failed”, “delivery status notification”, or “undeliver”. Ordinary correspondence can match these phrases; the rule does not prove the message is a genuine bounce.

550 Emails containing "your-subject" in the subject line are not allowed

The subject contained the literal placeholder your-subject.

550 Emails containing "~|" in the subject line are not allowed

The subject contained the literal two-character sequence ~|.

Spam scores

These responses mean a message reached a spam-score rejection threshold. They are distinct from the address and server-name rules above.

An MXroute recipient can review and adjust the relevant Spam Filters and Sender Lists settings. The scoring threshold does not control every rejection on this page. There is no rejected copy to release from a mailbox quarantine; the sender must resend once the cause is resolved.

Error messages and what they mean

550 High scoring spam message has been dropped

The message reached the user high-score rejection threshold. The server also closes the SMTP connection.

550 Your message to <[recipients]> was classified as SPAM. Your score: [score]

The accumulated Easy Spam Fighter score reached the configured drop threshold. That score can include policy penalties as well as spam scoring, so do not treat it as interchangeable with the Control Panel’s SpamAssassin threshold. Thresholds can vary by server. The connection is closed.

Repeated failed delivery attempts

Repeated invalid recipients, failed logins, or rejected messages can trigger additional protections. Some checks reject a transaction; others block new connections from the sending IP.

Fix invalid recipients, stale credentials, or retry loops before sending again. For connection-level 554 blocks and their documented expiry periods, see Temporary SMTP Blocks. A block that expires can return if the same behavior continues.

Error messages and what they mean

550 "Too many RCPT failures - try later"

Too many recipient commands in the SMTP session have already failed. Despite “try later” in the text, this is a permanent 550 response for the rejected command. Other failed-recipient protections may close the connection sooner.

Other SMTP failures

Not every response has a single fixed wording. Server-specific checks can add detail or return a different message.

Sender verification or an unknown recipient

Sender verify failed means the server could not verify the envelope sender. For domains configured locally, that can mean the sender is not deliverable on that server even if public MX records point elsewhere. Follow Sender Verify Failed for mailbox, forwarder, and routing options.

No such recipient here or a similar unknown-user response means recipient verification failed. Check the address and, if the domain is local to MXroute, its mailbox or forwarder. This is common during migrations; see No Such Recipient Here.

Invalid characters or an invalid server introduction

550 Invalid characters in local_part concerns the part of a recipient address before the @ sign. Check for malformed address data. A generic Administrative prohibition needs the full SMTP context; it does not identify one unique policy.

Other HELO checks can reject a server that introduces itself as the receiving server, uses a bare IP on port 25, uses a blocked name, or provides certain malformed hostnames. The sending server’s administrator should investigate the complete response.

Account restrictions and automated notifications

Additional checks can reject repeated authentication attempts, accounts blocked from SMTP, or bounce/postmaster messages addressed to multiple recipients. Exact wording depends on the server. Correct the application or account issue rather than repeatedly opening new sessions.

Temporary local problems or a suspended domain

451 Temporary local problem - please try later can mean a lookup, DNS check, or address-verification step could not complete. A suspended local recipient domain can also return a temporary rejection. The generic 451 wording alone does not prove a domain is suspended or a spam rule matched.

Allow normal server retries. If the failure persists, the MXroute account owner should ask support to investigate with the full response and timestamp. Avoid a rapid manual retry loop.

Some internal proxy configurations have additional authentication errors. Ordinary email clients should use the server and ports in Email Clients & Webmail; provide unexpected proxy or authentication responses to support rather than switching to an undocumented port.

Will whitelisting fix it?

A whitelist entry is not a universal bypass. Server-name checks, sender or recipient restrictions, account limits, and several message rules can run before or independently of the customer’s spam-scoring settings.

Use Spam Filters and Sender Lists for the customer-managed controls. Follow the separate Expert Spam Filtering request process for its network-range error. Other policy rejections need the remedy or review described in their category.

Fixing one cause can expose a later check. A different error on the next attempt does not necessarily mean the first fix failed.

What to include when asking for help

Follow the documented correction first. Alias Sending, application settings, and customer-managed spam settings can be changed in the Control Panel or your mail software. Support is not a route around sending limits or prohibited activity.

If an error remains unexplained after those checks, or the response requires staff action, an MXroute customer can open a support ticket with:

• The full SMTP response or delivery-failure report, including the rejecting server.
• Sender and recipient addresses, plus the envelope sender if it differs from the visible From address.
• The date and time, with timezone.
• The sending server’s IP and HELO/EHLO name, if available.
• Whether this was incoming mail, authenticated sending through MXroute, or a forwarded message.
• The message subject, message ID if available, and any relevant recent changes.

If you are sending from another provider to an MXroute customer, ask your provider for the complete delivery failure and share it with the recipient. The MXroute account owner can then request review with those details.

The Email Logs alpha viewer can help with available records, but it is not a complete record of rejected connections. An empty search does not establish that delivery was never attempted.