Email Bounce Code 550: What It Means and How to Fix Each Variant

SMTP error 550 means the recipient's mail server received your email and permanently refused it. Resending the same message unchanged only returns another 550. The enhanced status code (such as 5.1.1, 5.4.1, 5.7.1 or 5.7.26) and the text after it tell you the exact cause: a bad address, a relay or authentication problem, or a reputation or policy block.

550 is not one error but a family of related rejections. This guide explains how to read a 550 bounce, what each common sub-code and message means, how Gmail, Outlook.com and Microsoft 365 use them, who has to fix each one, and how to stop them from coming back.

What SMTP error 550 means

SMTP servers answer every step of a mail transaction with a three-digit reply code: 2xx means success, 4xx means a temporary problem, and 5xx means a permanent one. Code 550 belongs to the 5xx family. The receiving server looked at your message and rejected it, and the sending server should not retry it as-is. That makes a 550 a hard bounce by definition, and it usually arrives as a non-delivery report (NDR), also called a delivery status notification (DSN).

The contrast with 4xx codes matters. A 4xx reply, like the ones described in our guide to the transient email error, is a "try again later" response that automatic retries often solve. A 550 says this attempt will not succeed under the current conditions. Something has to change first: the address, your authentication, your sending setup, or your reputation.

Most 550 replies include an enhanced status code defined in RFC 3463. The first digit repeats the class (5 = permanent), the second names the subject (1 = address, 2 = mailbox, 4 = routing or network, 7 = security or policy), and the third gives the detail. A small number of provider-specific 550s, such as Gmail's 5.4.5 daily quota block, lift on their own after about 24 hours, but the bounced message still has to be sent again.

How to read a 550 bounce message

A bounce lands in your inbox with a subject like "Mail delivery failed", "Undelivered Mail Returned to Sender" or "Delivery Status Notification (Failure)". Inside it you will find three useful pieces of information: the SMTP reply code, the enhanced status code, and a free-text explanation written by the receiving server.

A typical fragment looks like this:

Remote host said:
    550 5.1.1 <[email protected]>: Recipient address rejected: User unknown
Reporting-MTA: dns; mail.yourdomain.com
Action: failed
Status: 5.1.1

• The three-digit code (550) tells you the failure family: permanent rejection.
• The enhanced status code (5.1.1) narrows the category. Here, 1.1 means the destination mailbox address is bad.
• The text after the code is where the diagnosis lives: "User unknown", "Relay access denied", "Policy violation", "SPF check failed", "Daily user sending limit exceeded", and so on.

Copy that line word for word before you change anything. If you contact the recipient's admin, your hosting provider or your ESP, it is the first thing they will ask for. Also check the hostname in the bounce: a name ending in google.com, protection.outlook.com or yahoodns.net tells you which provider's rules you are dealing with.

550 enhanced status codes at a glance

Match the enhanced code in your bounce to its cause, then read the detail for that code below. If your bounce starts with a different number, such as 421, 552 or 554, use the full bounce code lookup table instead.

Enhanced code	What the server is telling you	Category	Who fixes it
550 5.1.0	Address rejected (sender or recipient not accepted)	Address	Sender
550 5.1.1	Recipient address rejected, user unknown	Address	Sender (list hygiene)
550 5.1.8	Sender address rejected (bad or blocked from-address)	Address / authentication	Sender
550 5.1.10	Recipient not found (Microsoft 365)	Address	Sender
550 5.2.1	Mailbox disabled or not accepting mail	Mailbox	Recipient
550 5.4.1	Recipient rejected: access denied (Microsoft 365) or relay access denied	Routing / relay	Recipient admin or sender
550 5.4.5	Daily sending limit exceeded (Gmail)	Quota	Sender
550 5.7.1	Message rejected: spam, policy, blocklist or relay	Policy / reputation	Sender
550 5.7.26	Unauthenticated mail: SPF, DKIM or DMARC failed (Gmail)	Authentication	Sender
550 5.7.509	DMARC failed on a domain with p=reject (Outlook.com)	Authentication	Sender
550 5.7.515	Sending domain does not meet required authentication level (Outlook.com)	Authentication	Sender

550 5.1.0 Address rejected

Usually shown as 550 #5.1.0 Address rejected or 550 5.1.0 sender rejected. It is a general "this address was not accepted" response that can refer to the recipient mailbox or to your own from-address. Check the recipient's spelling first. If the address is correct and the bounce names the sender, treat it like a 5.1.8: check your SPF record and domain reputation.

550 5.1.1 Recipient address rejected (user unknown)

The most common 550. The mailbox does not exist on that domain, usually because of a typo, an outdated address or a deleted account. Gmail phrases it as "The email account that you tried to reach does not exist". Correct the address or remove it from your list. Sending to it again will bounce again and hurt your sender reputation.

550 5.1.8 Sender address rejected

Here the receiving server refused your from-address, not the recipient. The sending domain looks invalid, unauthenticated or blocked to the receiver. Make sure the from-address is a real mailbox on a domain with a valid MX record, SPF and DKIM before you resend.

550 5.1.10 Recipient not found (Microsoft 365)

Microsoft's version of "user unknown", often shown as RESOLVER.ADR.RecipientNotFound. The address does not exist in the recipient's Microsoft 365 tenant. Confirm the address with the recipient and update your records.

550 5.2.1 Mailbox disabled

The recipient address exists but the mailbox is disabled, suspended or not accepting messages. Some servers also return 5.2.1 for an over-quota mailbox, although "mailbox full" is formally 5.2.2 and usually arrives with a 552 code. There is nothing to fix on your side. Contact the person another way and retry once they confirm the mailbox is active.

550 5.4.1 Recipient address rejected: Access denied / Relay access denied

This code has two different meanings, and the bounce text tells you which one you have.

On Microsoft 365, 550 5.4.1 Recipient address rejected: Access denied. AS(201806281) means Exchange Online Protection checked the recipient against the tenant's directory and could not find it. This feature is called Directory-Based Edge Blocking (DBEB). If the address is genuinely wrong, correct it. If you are sure it is right, the problem is on the recipient side: their admin needs to confirm the mailbox or alias exists in Exchange Online, that it has synced from on-premises Active Directory in hybrid setups, and that the domain's MX record points to the correct tenant.

On other servers, 550 5.4.1 Relay access denied means the outgoing server does not recognise you as allowed to send through it. Enable SMTP authentication in your email client and use the SMTP server that belongs to your mail account.

550 5.4.5 Daily user sending limit exceeded (Gmail)

Your Gmail or Google Workspace account sent more messages or recipients than its rolling 24-hour limit allows. Google lists 500 per day for a free Gmail account and 2,000 per day for Workspace, and limits for mail sent through SMTP from apps are lower in practice. Sending resumes automatically about 24 hours after the block starts. Spread sends across the day, and use a dedicated sending service for bulk or cold outreach. Workspace-specific causes are covered in our guide to the 550 permanent failure in Google Workspace.

550 5.7.1 Message rejected (spam, policy, reputation or relay)

The receiving server's filter or policy blocked the message. Common wordings include "Message rejected as spam", "Reject due to policy restrictions", "Client host blocked using Spamhaus", "Your IP is blacklisted" and "Unable to relay". The fix is reputation, authentication or relay configuration, not resending the same message. Check the text closely: if it names a blocklist, start with delisting; if it says "unable to relay", treat it like the relay variant of 5.4.1.

550 5.7.26 This mail is unauthenticated (Gmail)

Gmail returns 5.7.26 when a message fails sender authentication. Typical wordings are "This mail has been blocked because the sender is unauthenticated" and "Unauthenticated email from yourdomain.com is not accepted due to domain's DMARC policy". Audit your SPF, DKIM and DMARC: every sending source must be in SPF and within the 10-lookup limit, DKIM must sign every source, and the authenticated domain must align with the visible From domain.

550 5.7.509 and 550 5.7.515 (Outlook.com)

These are Microsoft's consumer-mailbox authentication rejections for outlook.com, hotmail.com, live.com and msn.com. 550 5.7.515 Access denied, sending domain does not meet the required authentication level applies to domains sending more than 5,000 messages a day to Outlook.com. Since May 5, 2025, those domains need passing SPF, passing DKIM and a DMARC record of at least p=none, aligned with the From domain. 550 5.7.509 means the message failed DMARC on a domain whose policy is p=reject. Both are sender-side fixes.

Common 550 error messages and what they mean

Many servers return a 550 with only a text message and no enhanced code. Use this table to translate the wording you see.

Message text	What it usually means	Closest code
550 Requested action not taken: mailbox unavailable	The recipient mailbox does not exist or cannot be reached	5.1.1 / 5.2.1
550 No such user here / User unknown / Mailbox not found	The address does not exist on that domain	5.1.1
550 Recipient address rejected	Invalid recipient, or blocked by the recipient's directory check	5.1.1 / 5.4.1
550 Relay not permitted / Relay access denied	You are not authenticated with the outgoing server	5.4.1 / 5.7.1
550 Authentication required	SMTP authentication is turned off in your client	5.7.1
550 SPF check failed	The sending IP is not authorised in your SPF record	5.7.1 / 5.7.26
550 Reject due to policy restrictions	Content, reputation or local policy block	5.7.1
550 Blocked / Your IP is blacklisted	Your sending IP or domain is on a blocklist	5.7.1
550 Access denied – Invalid HELO name	Your server announced a hostname that does not match its DNS	5.7.1
550 Permanent failure for one or more recipients	At least one recipient was rejected; read each recipient's line	Varies

What causes a 550 error: sender side vs recipient side

The quickest way to stop guessing is to decide which side of the conversation has the problem. A useful test: if every message to one address bounces, look at that address; if messages to many domains bounce, look at your own setup.

Recipient-side causes

A disabled or suspended mailbox (5.2.1) and Microsoft 365 directory problems (5.4.1 with "Access denied") are caused on the receiving end. You cannot fix them yourself. Send the exact bounce line to the recipient or their IT admin and ask them to check the mailbox status, directory sync and MX record.

Address and list problems

Typos, outdated addresses and deleted accounts produce 5.1.1, 5.1.0 and 5.1.10. These are the sender's responsibility: correct the address or suppress it, and verify lists before you send.

Relay and client configuration

"Relay denied" or "authentication required" means the SMTP server you are sending through does not trust you. This usually happens when SMTP authentication is turned off in the email client, when the client points at the wrong outgoing server, or when you send through an ISP's server from a different network. The fix is configuration, not reputation.

SPF, DKIM and DMARC failures

Since Gmail and Yahoo began enforcing their bulk sender requirements in February 2024, and Outlook.com followed in May 2025, authentication failures have become one of the largest sources of 550 5.7.x bounces. They are most common after a domain change, an ESP migration, or when a CRM, helpdesk or transactional tool starts sending on your behalf without being added to SPF and DKIM.

Spam, blocklists and reputation

A 550 5.7.1 from a major mailbox provider usually means your message tripped a spam filter or your sending IP and domain have a poor reputation. Typical triggers are a listed sending IP, a new domain ramping volume too quickly, spam-like content, or a shared IP damaged by another sender. Improving your sender reputation is the only lasting fix.

Volume and rate limits

Providers enforce sending limits even when content is fine. Gmail returns 550 5.4.5 when an account passes its daily limit, and Microsoft 365 applies its own recipient and message rate limits. Cold outreach from a fresh mailbox or domain hits these walls quickly, so warm up senders and add volume gradually.

How to fix an email bounce code 550

Work through these steps in order and skip a step only when it is already confirmed.

1. Classify the variant. Copy the full bounce line, note the enhanced status code and the text, and note which provider's hostname appears. The variant decides which step applies next.
2. Fix address errors (5.1.x). Check the recipient's spelling, both before and after the @. If the CRM record changed recently, confirm the new value. Remove addresses that are confirmed invalid.
3. Escalate recipient-side errors (5.2.1, Microsoft 365 5.4.1). Contact the person another way and send their admin the exact bounce line. For 5.4.1 "Access denied", ask them to confirm the mailbox exists in Exchange Online and that the domain's MX record points to their tenant.
4. Fix relay errors (5.4.1 relay, "relay not permitted"). Turn on SMTP authentication in your client, use the outgoing server for your mail account, and check the port and encryption settings (usually 587 with STARTTLS or 465 with SSL/TLS).
5. Fix authentication errors (5.7.26, 5.7.509, 5.7.515, many 5.7.1). Make sure SPF includes every sending source and stays within 10 DNS lookups, DKIM signs mail from every source, and DMARC is published with at least p=none and aligns with the visible From domain.
6. Fix reputation and policy errors (5.7.1). Check your sending IP and domain on public blocklists. If you are listed, remove the cause first, then follow the delisting procedure. If your IP is shared and keeps getting listed, move important mail to a dedicated IP and warm it up.
7. Fix rate-limit errors (5.4.5). Wait for the 24-hour window to reset, then throttle sending below 500 per day on free Gmail or 2,000 per day on Workspace. Move bulk and cold outreach to a sending service built for volume.
8. Test before you retry. Send a test message to a mailbox you control on the same provider and confirm that it arrives with SPF, DKIM and DMARC passing in the headers. Only then resend to the original recipient.

If you run your own mail server

Search your mail log for the rejection to see the full SMTP conversation. On Postfix that is usually grep " 550 " /var/log/mail.log, and on Exim grep " 550 " /var/log/exim_mainlog. Check that your server's HELO name resolves, that the sending IP has a matching PTR (reverse DNS) record, and that outbound port 25 is not filtered by your hosting provider.

How to prevent 550 errors going forward

Keep authentication aligned

Publish SPF, DKIM and DMARC for every domain you send from, and re-check them whenever you add a sending tool. A clean authentication setup removes the largest group of 550 5.7.x bounces before they happen and keeps you compliant with Gmail, Yahoo and Outlook.com sender requirements.

Maintain list hygiene

Verify addresses before you send, especially for newsletters and cold outreach. Hard bounces from invalid addresses raise your bounce rate, and mailbox providers and ESPs lower your standing when that rate climbs. For anything beyond a handful of contacts, verify your list in bulk before sending with a bulk email verification service, and suppress repeat hard bouncers permanently.

Watch your sending volume

Sudden spikes look like spam. Warm up new domains and IPs gradually, add only as much daily volume as engagement supports, and keep one-off campaigns away from steady transactional traffic. The full playbook is in our guide on how to improve email deliverability.

Separate transactional from marketing mail

If marketing and transactional mail share one domain, a poorly targeted campaign can drag down the reputation that order confirmations and password resets depend on. Put marketing on its own subdomain so a reputation hit stays contained.

Monitor bounces and provider dashboards

Set an alert for jumps in your hard bounce rate and investigate the specific 5.x.x code within hours. Use Google Postmaster Tools for Gmail reputation and authentication data, and Microsoft SNDS for Outlook.com IP data. Catching a 5.7.1 spike on a new IP the same day usually means a short dip; catching it a week later usually means weeks of recovery.

Common 550 error questions

What does error 550 mean in plain terms?

The recipient's mail server permanently refused your email. It will not be delivered if you send it again unchanged, so fix the cause named in the bounce text first.

Is a 550 error a hard bounce?

Yes. Every 5xx reply, including 550, is a hard bounce. Most ESPs suppress the address automatically after a 550 5.1.1. Rate-limit codes such as Gmail's 5.4.5 are the exception: the block lifts after about 24 hours, but the message itself still bounced.

Is a 550 error my fault or the recipient's?

It depends on the code. Address, relay, authentication, reputation and quota errors (5.1.x, 5.4.1 relay, 5.4.5, 5.7.x) are fixed on the sender side. A disabled mailbox (5.2.1) and Microsoft 365 "Access denied" (5.4.1) are fixed on the recipient side.

Why do I get a 550 when the email address is correct?

The rejection is probably about you, not the address. Look for a 5.7.x code: it points to failed SPF, DKIM or DMARC, a blocklisted IP, or a content filter. On Microsoft 365, a correct address can still return 5.4.1 if the recipient's directory or MX record is misconfigured.

Can I resend an email after a 550 bounce?

Only after you change what caused it. Correct the address, fix authentication or relay settings, or repair reputation depending on the code, then send a test message before retrying.

What is the difference between 550 5.1.1 and 550 5.7.1?

5.1.1 is an address problem: the mailbox does not exist, so the fix is list hygiene. 5.7.1 is a policy or reputation problem: your message or IP was blocked, so the fix is deliverability work. They are never solved the same way.

What is the difference between 550 and 554?

Both are permanent failures. 550 usually means the action was refused for a specific mailbox or policy reason, while 554 is a general "transaction failed" response that many servers use for spam and blocklist rejections, sometimes before the recipient is even checked.

Is 550 an HTTP status code?

No. 550 is an SMTP reply code used by mail servers. HTTP server errors are codes like 500 and 503, and there is no standard HTTP 550. FTP does use 550 for "file unavailable" or "permission denied", so if the error appeared while uploading files rather than sending email, you are looking at an FTP error instead.

The bottom line on 550 errors

A 550 is a permanent rejection, but it is never vague once you read the enhanced status code and the text after it. Identify the variant, decide whether the fix sits with you or the recipient, fix that one category (address, relay, authentication, reputation or quota), and send a test before you retry. That habit resolves almost every 550 bounce a sender will see.