How to Actually Read a Bounce Message

A bounce message looks like noise until you know how to read it, at which point it's one of the most precise diagnostic signals in email. Every bounce carries a numeric SMTP reply code and, usually, an enhanced status code that together tell you exactly what went wrong and whether it's worth trying again.

Anatomy of an SMTP reply

The reply code is three digits. The first digit tells you the category: 2xx is success, 4xx is a temporary failure, 5xx is a permanent failure. Alongside it, most modern servers include an enhanced status code in the form class.subject.detail (for example 5.1.1), which narrows the reason down considerably further than the three-digit code alone.

550 5.1.1 The email account that you tried to reach does not exist.
│    │ │ │
│    │ │ └─ detail: specific address problem
│    │ └─── subject: address
│    └───── class: permanent failure
└────────── reply code: rejected outright

Soft bounces vs hard bounces

A 4xx code is a soft bounce: the receiving server is telling you to try again later. It might mean a full mailbox, a temporary rate limit, or a greylisting delay used deliberately to filter automated senders. Most sending systems retry a soft bounce automatically for a period before giving up. A 5xx code is a hard bounce: a permanent failure that will not resolve on retry. The address doesn't exist, the domain doesn't exist, or the message was rejected outright on content or policy grounds. Hard bounces should be suppressed immediately; continuing to send to one damages sender reputation with no possible upside.

Common codes and what they actually mean

Enhanced status codes: the second number tells the real story

• x.1.x: address status: the mailbox or domain itself is the problem (x.1.1 mailbox doesn't exist, x.1.2 bad domain).
• x.2.x: mailbox status: the mailbox exists but has a problem (x.2.1 disabled, x.2.2 full).
• x.4.x: network/routing status: a problem delivering the message across the network path.
• x.7.x: policy status: the message was blocked on purpose, often for reputation, authentication failure, or content filtering.

Common bounce strings translated

• "Mailbox unavailable" or "user unknown": the address doesn't exist; suppress it permanently.
• "Message rejected due to content" or "message contains prohibited content": a policy filter, not an address problem; review the message body and links.
• "IP temporarily blocked" or "too many connections": a reputation or rate signal on the sending server, not the recipient.
• "Mailbox full": a genuine soft bounce; retry later, but repeated occurrences over weeks suggest an abandoned address.
• "Spam detected" or "message identified as spam": a content or reputation rejection at the policy layer, worth treating as a deliverability signal, not just a single failed send.

What to do with each type

Hard bounces go straight to your suppression list. No exceptions, no manual retry. Soft bounces should retry automatically with backoff, but if the same address soft-bounces across three or more separate days, treat it as a hard bounce and suppress it; a mailbox that's been full for a week isn't coming back. Policy-based rejections (x.7.x, "content" or "spam" strings) deserve a different response entirely: they're telling you something about the message or the sending domain, not the recipient, so investigate the sending pattern before resending anything similar.