With an email security gateway in front of Exchange Server, a bounce can come from the gateway, from Exchange or from the sender's side, and the SMTP reply tells you which. Below are the rejection and deferral replies Mimecast documents, selected replies Barracuda and Fortinet document, two Cisco Secure Email Gateway (formerly IronPort) replies, and the Exchange replies a gateway passes on. Press Ctrl+F, type the distinctive words of your reply and see who fixes it.
Codes in this quick reference
421 Sender address blocked (Mimecast Blocked Senders policy matched the IP)Sender's NDR / Mimecast rejection log451 Unable to process connection at this time (Mimecast at maximum load)Sending server queue451 Internal resources are temporarily unavailable (Mimecast greylisting or IP reputation)Sending server queue / Mimecast log451 Message ended early (Mimecast: message incorrectly terminated)Sending server queue / NDR451 An open relay is not allowed (Mimecast: connecting IP not authorized)Exchange queue LastError / NDR451 Account outbounds disabled / Account inbounds disabled (Mimecast account setting)Queue LastError / NDR451 Account service is temporarily unavailable (Mimecast: too many concurrent connections)Exchange queue LastError451 Recipient Temporarily Unavailable (Mimecast recipient validation not responding)Sending server queue / Mimecast log
+ 40 more codes in the tables below.
How to read these codes#
A gateway replies during the SMTP session, so look where the sending server records it:
- Inbound (internet to gateway): the external sender gets the NDR and the gateway logs it; in Mimecast, under Message Center › Rejected and Deferred Messages in the Administration Console.
- Outbound (Exchange to gateway smart host): a 4xx leaves the message queued with the reply in
LastError; a 5xx produces an NDR that quotes it afterRemote Server returned. - Gateway to Exchange: the gateway's queue or log shows Exchange's reply (last table).
A 4xx is temporary: a correctly configured server retries, and gateways use it on purpose for greylisting. A 5xx is permanent: the message was refused in the SMTP conversation, can't be released from the gateway and must be resent after the fix.
First check starts with who fixes it: Gateway (its policies), Exchange (connectors, certificates, limits) or Sender (the sending side's server or DNS). Real replies can differ slightly from vendor documentation, for example with an appended reference or help link.
PowerShell
# Gateway replies to outbound mail
Get-Queue | Where-Object MessageCount -gt 0 | Format-List Identity, NextHopDomain, Status, MessageCount, LastError
# Failures in the last 24 hours
Get-TransportService | Get-MessageTrackingLog -EventId FAIL -Start (Get-Date).AddHours(-24) -ResultSize Unlimited |
Select-Object Timestamp, Sender, Recipients, RecipientStatus
# Log SMTP conversations with the gateway
Set-SendConnector "Outbound via gateway" -ProtocolLoggingLevel VerboseThe send protocol log (%ExchangeInstallPath%TransportRoles\Logs\Hub\ProtocolLog\SmtpSend) then shows the gateway's exact answers; see SMTP protocol logging and message tracking.
Mimecast#
Based on Mimecast's support article Policies - Mimecast SMTP Error Codes. Mimecast asks external senders to take these to the recipient's Mimecast administrator, as it only deals with designated customer contacts. For connector design see Mimecast with Exchange Server; for journaling, journaling to a third-party archive.
Temporary replies (4xx)#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
421 Sender address blocked | A Blocked Senders policy matched the sending IP | An administrator's block entry | Gateway: remove or narrow the entry |
451 Unable to process connection at this time | Mimecast server at maximum load | Temporary capacity | Sender: nothing to fix; it goes through once resources free up |
451 Internal resources are temporarily unavailable | Greylisting, or poor reputation of the sending IP | A new sender, or a low-reputation IP | Sender: keep retrying (one minute to 12 hours). Gateway: Auto Allow or Permitted Senders skip reputation checks; tune the Greylisting policy |
451 Message ended early | The message wasn't terminated correctly | Firewall SMTP inspection, intrusion detection or security-device content rules | Sender: turn off SMTP fixup, MailGuard or ESMTP inspection on firewalls in the path, including yours |
451 An open relay is not allowed | Neither domain belongs to the account, or the connecting IP isn't authorised | Exchange sending from an unknown IP (new server or NAT address) | Exchange: check the public IP your source servers use. Gateway: Mimecast Support adds it as an Authorized Outbound address |
451 Account outbounds disabled / 451 Account inbounds disabled | Outbound or inbound mail is disabled for the account | Account setting | Gateway: Mimecast Support |
451 Account service is temporarily unavailable | Too many concurrent inbound connections for the account (default 20) | Many connections at once, or an unauthorised IP retrying | Exchange: send and journal only from authorised IPs; fewer parallel connections |
451 Recipient Temporarily Unavailable | Recipient validation isn't responding, or the IP is briefly blocked after too many invalid connections | Recipient check can't complete | Gateway: check that its LDAP or SMTP call-forwarding targets answer. Sender: retry |
451 IP Temporarily Blacklisted | The sending server reached a limit | Volume | Sender: wait; mail is refused until it's back under the limit |
451 The incorrect hostname used for inbounds (also as 550) | The recipient domain's MX points to hostnames meant for outbound | MX misconfiguration | Gateway/DNS: MX records may point only to Mimecast inbound hosts |
452 Too many recipients | More than 100 RCPT TO for one message (Mimecast default) | Large distribution sends | Sender: usually nothing, as servers send the rest in another batch; if a device in the path breaks this, stay at 100 |
454 TLS not available due to temporary reason | TLS enabled but no valid certificate selected | Secure Receipt/Delivery policy, expired certificate, or a proxy altering TLS | Gateway: the TLS policy. Exchange: valid certificate; no TLS-inspecting proxy |
Permanent replies (5xx)#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
535 Incorrect authentication data / 550 Submitter failed to authenticate | Authenticated submission on port 587 failed | Wrong credentials | Exchange: the send connector's AuthenticationCredential must be an internal Mimecast address with its Mimecast cloud password; or use port 25 from an authorised IP |
550 Administrative prohibition envelope blocked | Blocked Senders policy or an SPF hard fail | Admin block, or the sender's SPF | Gateway: Blocked Senders policy. Sender: SPF record |
550 Anti-Spoofing policy - Inbound not allowed / 550 Rejected by header-based Anti-Spoofing policy | An Anti-Spoofing policy matched | Outside mail using your domain, such as a SaaS app | Gateway: a narrow Anti-Spoofing policy with no action for that address or IP |
550 Envelope blocked - User Entry / User Domain Entry / Rejected by header-based manually Blocked Senders - block for manual block | A personal block set by the recipient | The user's Managed Senders list | Gateway: remove the address or domain from Managed Senders |
550 Rejected by header-based Blocked Senders - Block policy for Header From / 550 Envelope Rejected - Block policy for Envelope from address | A Blocked Senders policy on the Header From or Envelope From | Admin policy | Gateway: delete or change the policy |
550 <details of RBL> | The sending IP is on an RBL; the text names the list | Sender reputation | Sender: delisting. Gateway: Auto Allow or Permitted Senders bypass the RBL |
550 Local CT IP Reputation - (reject) | Rejected by ongoing IP reputation checks, sometimes after a 4xx | Poor IP reputation | Gateway: Auto Allow or Permitted Senders. Sender: Mimecast offers a review form for source IPs |
550 Invalid Recipient | Recipient validation found no valid internal user | New mailbox or alias not yet known to Mimecast; typo | Exchange: Get-Recipient user@contoso.com; then the gateway's directory sync or validation target |
550 Exceeding outbound thread limit | Too many concurrent outbound connections for the account | Exchange opening many connections at once | Exchange: smaller batches, fewer parallel connections |
550 Message bounced due to Content Examination Policy | A Content Examination policy matched | Admin content rule | Gateway: Content Examination Bypass policy, or adjust the rule |
550 SPF Sender Invalid - envelope rejected | Sending IP missing from the domain's SPF record | Incomplete SPF | Sender: SPF record. Gateway: DNS Authentication policy with Inbound SPF or Reject on Hard Fail disabled |
550 DKIM Sender Invalid - envelope rejected | The DKIM signature doesn't match the DNS record | Key mismatch in the Outbound Signing definition | Gateway/DNS: the DNS public key matches the signing key pair, domain and selector |
550 DMARC Sender Invalid - envelope rejected | DMARC failure; Mimecast's description points at the originating IP missing from SPF | Sender authentication | Sender: SPF and DKIM alignment (SPF, DKIM, DMARC) |
550 Journal messages past the expiration | Journal reports older than the expiry threshold | An old journal backlog or a wrong server clock | Exchange: server time; stop journaling old messages (they're retried, so the queue grows) |
553 This route requires encryption (TLS) | Policy requires TLS; the session was plain SMTP | Connector without TLS | Exchange: connector TLS settings and certificate. Gateway: the TLS policy |
553 This route requires TLS version 1.2 or greater / 553 This route requires high-strength ciphers | TLS version or cipher below the policy | Outdated TLS configuration | Exchange: TLS 1.2 and cipher settings |
554 Email rejected due to security policies | Virus, spam score over the threshold (MCSpamSignature) or a malicious QR code URL | Message content | Gateway: anti-virus can't be bypassed; anti-spam via Permitted Senders or Auto Allow; legitimate QR links as Permitted URLs |
554 Mail loop detected | Too many Received headers: rejected at 25 hops | Forwarding between systems | Exchange: forwarders, contacts and connectors (mail loops) |
554 Maximum email size exceeded | Over an Email Size Limit policy or the service limit (defaults: 100 MB legacy MTA, 200 MB latest MTA) | Attachments plus encoding overhead | Gateway/Exchange: align the limits (size limits) |
Cisco Secure Email Gateway (IronPort)#
Cisco reply texts can be customised on the gateway, so yours may differ. The first reply is reported by admins on the Cisco Community, where a Cisco engineer explains it; the second is documented in Cisco TechNote 118495, which also lists 500 #5.5.1 command not recognized and 421 Exceeded bad SMTP command limit. For listeners, HAT and RAT, see Cisco Secure Email Gateway with Exchange Server.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
554 Your access to this mail system has been rejected due to the sending MTA's poor reputation | The sending IP matched the sender group for poor-reputation senders | Sender IP reputation | Gateway: find the matched sender group in mail_logs; check the IP with Cisco Talos; allow it only if legitimate |
552 #5.3.4 message header size exceeds limit | The message headers are larger than the gateway accepts | Unusually large message headers | Gateway: the listener settings shown in TechNote 118495. Sender: what inflates the headers |
Barracuda, FortiMail and Proofpoint#
Only replies found in each vendor's own documentation are listed. Guides: Barracuda, FortiMail, Proofpoint and the vendor-neutral gateway checklist.
Barracuda Email Security Gateway#
From the SMTP reply table Barracuda Campus publishes for the appliance. It doesn't cover Email Gateway Defense or the bounce admins most often report, 550 permanent failure for one or more recipients (...:blocked); the Message Log shows the reason.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
554 Service unavailable; client host [IP or hostname] blocked using Barracuda Reputation | Sending IP on the Barracuda Reputation Block List | Poor IP reputation, often your own public IP | Sender: the IP's reputation. Gateway: exempt a legitimate sender |
554 IP name lookup failed. No PTR record found for the given IP address. | No reverse DNS for the sending IP | Missing PTR record | Sender: a PTR record from your ISP |
550 Rejecting for Sender Policy Framework (SPF) | SPF check failed | Sending IP missing from SPF | Sender: SPF, including your gateway or smart host |
554 Rejected due to spam content / 554 Rejected due to virus | Content verdict | Spam score or malware | Gateway: the Message Log reason |
FortiMail#
From Fortinet's Troubleshoot MTA issues; a 5.7.1 reply without the relay text can mean a reputation threshold was passed.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
550 5.7.1 Relay access denied | No relay permission | Exchange server not covered by an access control rule or authentication | Gateway: access control rule, or SMTP authentication on the send connector |
451 Try again later | Temporary refusal | Greylisting, or the recipient verification server is unreachable (TEMPFAIL in the antispam log) | Sender: retry. Gateway: verification server connectivity |
Proofpoint#
Not tabulated: the Proofpoint Essentials replies admins report couldn't be checked against Proofpoint's public documentation; the Proofpoint guide lists them as reported.
Exchange's own replies, as the gateway reports them#
If the gateway's queue or log shows one of these, it's passing on Exchange's refusal: fix it on Exchange. More codes are in the Exchange NDR quick reference.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
550 5.7.54 SMTP; Unable to relay recipient in non-accepted domain | Exchange won't relay to a domain it doesn't own | Domain missing from Exchange's accepted domains, or outbound relay through an anonymous connector | Exchange: Get-AcceptedDomain; relay guide |
530 5.7.1 Client was not authenticated | The receive connector that answered doesn't accept anonymous mail | The gateway's IP lands on the wrong connector | Exchange: Get-ReceiveConnector | Format-Table Name, Bindings, RemoteIPRanges, PermissionGroups; guide |
452 4.3.1 Insufficient system resources | Exchange back pressure | Low disk space on the queue drive, or memory pressure | Exchange: back pressure guide |
4.3.2 Service not available / Service not active | Exchange transport isn't accepting mail | Maintenance mode, or components left inactive after an update | Exchange: Get-ServerComponentState -Identity EX01; guide |
5.3.4 Message size exceeds fixed maximum message size | Larger than Exchange accepts | The gateway allows bigger messages than Exchange | Exchange: align the limits (size limits) |
554 5.4.6 Hop count exceeded - possible mail loop | Mail loop | Exchange and the gateway each routing the domain back to the other | Exchange: accepted domain type, send connectors (loop guide) |
441 4.4.1 Error encountered while communicating with primary target IP address | Outbound: Exchange can't reach the gateway smart host | Firewall, wrong smart host, gateway down | Exchange: Test-NetConnection gw.contoso.com -Port 25; guide |
454 4.7.5 The certificate specified in TlsCertificateName of the SendConnector could not be found | Outbound: the send connector's TLS certificate is missing | Certificate renewed, connector not updated | Exchange: event 12014 guide |
451 5.7.3 Must issue a STARTTLS command first | TLS required but not started | A connector requiring TLS, or failed TLS negotiation | Exchange: certificate and TLS 1.2 (gateway checklist) |
How to verify a fix#
- Outbound: retry the queues, then confirm they drain and tracking shows a
SENDevent to the gateway:PowerShellRetry-Queue -Filter "Status -eq 'Retry'" Get-Queue | Where-Object MessageCount -gt 0 | Format-Table Identity, Status, MessageCount, LastError - Inbound 4xx: the sender's server retries; the gateway log shows it accepted and Exchange records a
RECEIVEfrom the gateway. - Inbound 5xx: ask the sender to resend after the fix.
- Protocol log: the gateway answers
250after the message data in the SmtpSend log. - Gateway log: no new rejections for that sender, recipient or IP.
References#
- Policies - Mimecast SMTP Error Codes (Mimecast; source of the Mimecast tables)
- SMTP reply table, Barracuda Email Security Gateway documentation (Barracuda Campus; page titled Controlling Access to Account Features)
- Troubleshoot MTA issues (FortiMail Administration Guide)
- Can't send or receive email when using TLS 1.1 or TLS 1.0 (Microsoft Learn)
