Hard bounce vs soft bounce: 5xx refusals and 4xx retries

A hard bounce is a refusal. The receiving server answered with a code starting 5, and your server gave up on that message. A soft bounce is a delay. The receiver answered with a code starting 4, and your server put the message back in its queue to try again later.

What you need from a bounce is who owns the fix. Sometimes that's the recipient's admin and sometimes it's you. Read the status code in the reply to find out which.

Does a soft bounce fix itself? Sometimes. If the receiver keeps saying 4xx, your server gives up after a few days and the final notice looks exactly like a hard bounce.

Steps for any bounce

1. Find the reply line. It starts with a three-digit code and usually carries a dotted status like 5.7.26 after it. Our email bounced back page shows where it sits in Gmail, Outlook and a raw notice.
2. Read the first digit. A 5 means the receiver refused and your server stopped. A 4 means it's still trying, or it tried for days and then stopped.
3. Read the middle digit of the dotted status. A 1 or 2 is about the recipient's address or mailbox. A 7 is about policy: authentication, reputation or content.
4. Match it in the table below. An address error goes to the person you wrote to. A policy error is yours to fix.

Hard bounces (5xx)

The receiving server answered a command with a 5xx reply. RFC 5321 calls that a permanent negative completion. Your server doesn't retry. It writes you a delivery status notification instead, with the receiver's reply quoted inside it.

Permanent means permanent for that message. Send it again unchanged and you get the same reply. Fix the cause first, whether that's the address or your DNS, and then send once.

Soft bounces (4xx)

The receiver answered 4xx. RFC 5321 calls that a transient negative completion, and your server tries again later. Postfix keeps trying for five days by default. Gmail and Microsoft 365 run similar windows. During that time you get nothing, or a notice with the subject line Delay and the word delayed in the Action field.

Some 4xx replies clear on their own. A full mailbox gets emptied, a busy server comes back, greylisting lets the second attempt through. Others never clear, because the receiver sends the same 4xx reply on every attempt. Gmail's rate limit, 421-4.7.28, is the common one. Your server retries the same message into the same limit for days, then gives up and sends a failure notice.

A soft bounce that never clears ends the same way as a hard bounce, with a final notice that says failed. The original reply sits under days of retries. Find it and read its code, because that's where the fix is.

The hard and soft labels

The mail protocol has 4xx and 5xx. It doesn't have hard or soft. Those labels come from the sending platforms, the Mailchimps and SendGrids, which need a rule for when to stop sending to an address. Each platform sets its own rule. A 5xx spam block can count as soft on one platform, because the address itself is fine, and as hard on another.

So two platforms can label the same address differently, and a dashboard label doesn't tell you the cause. When a platform marks an address as hard-bounced, open the bounce and read the code before you delete anyone.

The dotted status code

Most replies carry a second code, three numbers with dots, from RFC 3463. The first number repeats the class, 4 or 5. The middle number is the one to read, because it shows what kind of thing went wrong.

Status	What it's about	Who fixes it
X.1.x	The address. It doesn't exist, or the domain has no mail server.	You, if it's a typo. Otherwise the recipient's admin.
X.2.x	The mailbox. Disabled, full, or over a limit.	The recipient or their admin.
X.3.x	The receiving system. Out of storage, or not accepting mail.	The receiving admin.
X.4.x	The network. Timeouts, routing, a connection the receiver dropped.	Usually clears. If it doesn't, one of the two admins.
X.5.x	The protocol. A command the receiver didn't accept.	Your server's admin.
X.6.x	The content. An attachment type or size.	You.
X.7.x	Policy. Authentication, reputation, spam filtering, a rule the recipient set.	Mostly you.

Most bounces fall in the X.1, X.2 and X.7 rows. An X.1 or X.2 is about the person you wrote to. An X.7 is about you.

Address and mailbox errors

These bounces are hard, and the fix is at the recipient's end. Check the spelling, drop the address from any cached autocomplete, and ask the person another way. No DNS record on your side changes the answer.

• 550 5.1.1: the mailbox doesn't exist. It's a typo, or the person left.
• 550 5.2.1: the mailbox exists and is disabled or inactive.
• 552 5.2.2 or 452 4.2.2: the mailbox is full. Wait, or phone the person.
• 550 5.4.1: Microsoft's version of no such recipient, worded as access denied.

Authentication failures

The address is fine. The receiver looked at who sent the message, checked it against the DNS records for your domain, and refused. Every message from that sending system to that receiver is failing the same way, whether or not you've seen the bounces yet.

• 550-5.7.26: Gmail found no SPF pass and no DKIM pass, or applied your DMARC reject.
• 550 5.7.1 that mentions DMARC: any receiver that enforced your own p=reject.
• 550 5.7.515: Microsoft refused a high-volume sender with no authentication.
• 550 5.7.509: Microsoft applied your DMARC policy.
• 550 5.7.23: Microsoft failed SPF for the connecting server.
• SPF permerror: your record needs more than 10 lookups, so SPF fails for everyone.

The fix is a DNS change, and it's the same change no matter which recipient bounced. Put the sending service in your SPF record, turn on its DKIM signing, and make sure the domain in the visible From matches one of them. Alignment is the part people get wrong. Then send one test message and read the reply before you send the rest.

Reputation and content refusals

These are 5.7 codes too, and they're yours to fix, but the fix takes longer. Authentication passed and the receiver still refused the message.

• 554 5.7.1: the receiver's spam filter rejected the message or the connecting IP.
• 421-4.7.28: Gmail is rate-limiting the sending IP or domain. It's a soft bounce, and it repeats until your volume or your spam rate drops.
• 550 5.7.350: Microsoft's content filter.

Blocklist refusals belong here too. The reply usually says which list and gives a URL where you can look up your IP. Fix what got you listed before asking to be removed, because a second listing is harder to clear than the first.

Spam and quarantine without a bounce

Most big receivers accept a message they distrust and file it in spam or quarantine, because a refusal would tell a spammer what to change. Neither you nor the recipient gets a notice. Under your own DMARC p=quarantine, that's what you asked receivers to do.

As the sender, your only view of that is the DMARC aggregate reports that receivers send to the address in your record. They list each server that sent as your domain, whether it passed, and what the receiver did with it. Our quarantined email page covers that case, and reading a report by hand shows the rows to look for. Our weekly digest reads those reports for you and lists every sender that failed, and on a paid plan we email you the day an unfamiliar one first fails. Your first domain is free.