SMTP 554 means the receiving server permanently rejected your message as spam or a policy violation, it evaluated your IP, domain, or content and refused delivery, with no retry. The fix depends on the trigger named in the bounce text: delist your IP if it cites a blacklist, fix authentication if it cites policy, or strip the offending content if it cites filtering.
Read the bounce, the trigger is named
554 is a class, not a diagnosis. The text after it is the diagnosis:
| Bounce text pattern | Trigger | Fix path |
|---|---|---|
554 ... listed at zen.spamhaus.org (or other DNSBL) | IP/domain blacklist | Delist, then fix the cause |
554 5.7.1 Message rejected due to content | Content filter | Isolate the element (below) |
554 5.7.1 Service unavailable; Client host blocked | Receiver's local blocklist | Contact their postmaster |
554 5.7.9 Message not accepted for policy reasons | Auth/policy (common at Yahoo) | Fix SPF/DKIM/DMARC alignment |
554 5.2.0 ... STOREDRV.Deliver | Exchange-side processing failure | Receiver-side; retry/contact admin |
Step 1: Check the blacklists
Even if the bounce doesn't name a list, check, corporate gateways use DNSBLs silently:
IP=203.0.113.10
REV=$(echo $IP | awk -F. '{print $4"."$3"."$2"."$1}')
dig +short $REV.zen.spamhaus.org # Spamhaus ZEN
dig +short $REV.b.barracudacentral.org # Barracuda
dig +short $REV.bl.spamcop.net # SpamCop
Any 127.0.0.x answer means listed. Each list has its own delisting flow (Spamhaus via spamhaus.org's IP reputation checker, Barracuda via barracudacentral.org, SpamCop auto-expires in ~24h). Delisting without fixing the cause gets you relisted within days, find what triggered it first. Our guide on sending without getting blacklisted covers prevention.
Step 2: Verify authentication
A surprising share of 554s, especially Yahoo's 554 5.7.9, are alignment failures, not content. Confirm:
dig TXT yourdomain.com +short # SPF
dig TXT yourselector._domainkey.yourdomain.com +short # DKIM
dig TXT _dmarc.yourdomain.com +short # DMARC
If your DMARC policy is p=reject and your mail fails alignment, receivers are doing exactly what you told them to. Setup details: SPF, DKIM and DMARC guide.
Step 3: Binary-search the content
If IP and auth are clean, the message itself is tripping the filter. Don't guess, isolate:
- Send the exact failing message to a test address at the rejecting provider via swaks. Confirm it 554s.
- Send it again with all links removed. Passes? A URL is flagged, re-add links one at a time. Flagged shorteners and tracking domains are the #1 content trigger.
- Still fails? Remove attachments, then images/remote content, then suspicious phrasing (all-caps subjects, money/pharma vocabulary, excessive punctuation).
- A plain-text "hello" that still 554s means it's not content at all, back to IP/domain reputation.
swaks --to [email protected] --from [email protected] \
--server mail.yourdomain.com --port 587 --tls --auth \
--header "Subject: test 554 isolation" --body "plain text only"
Step 4: Check your domain, not just your IP
Filters score every domain in the message: From domain, link domains, tracking domain, even image-host domains. A clean IP with a flagged tracking domain still earns 554s. Test each domain at Spamhaus DBL:
dig +short yourtrackingdomain.com.dbl.spamhaus.org
Corporate gateways are their own world
Proofpoint, Mimecast, and Barracuda gateways reject things consumer providers deliver. If 554s come only from corporate recipients: their bounce usually includes a reference URL or rejection ID, use it. Proofpoint has an IP delisting form (ipcheck.proofpoint.com), Barracuda likewise. For a single important recipient, asking their IT to whitelist your domain is often faster than fighting the filter.
Separate your streams so one 554 can't sink everything
If transactional mail (receipts, password resets) and marketing campaigns share one IP and domain, a content-triggered 554 on a campaign takes your receipts down with it. Split them: marketing on its own subdomain (e.g., news.yourdomain.com) and ideally its own IP, transactional on another. Filters score the streams independently, so a flagged newsletter link never bounces an invoice. This separation is also what makes diagnosis fast, when only one stream starts hitting 554s, you already know where to look.
After the fix
A 554'd message already bounced; re-send it once the trigger is cleared. Then watch your logs for a week, a falling 554 rate confirms the fix, a flat one means you found a trigger but not the trigger. Long-term, the senders who never see 554s are the ones with dedicated IPs, aligned authentication, and engaged lists, the basics covered in our inbox placement guide and in how to reduce your email bounce rate.
How BulkEmailSetup helps
We run dedicated SMTP servers on monitored, pre-warmed IPs with authentication aligned out of the box, and we watch blacklists daily so a 554 source gets caught before your campaign does. Plans at pricing.
Frequently asked questions
What does SMTP error 554 mean?
It's a permanent rejection: the receiving server evaluated your connection or message and refused it, most commonly as suspected spam. Unlike 4xx errors, your server will not retry, the message bounces immediately.
Is a 554 error always about spam?
No, but usually. 554 is also used for policy violations, blacklisted IPs, and transaction failures. The text after the code tells you which, always read the full bounce line.
How do I find out which blacklist is causing 554 rejections?
Query the major DNSBLs directly with dig (Spamhaus ZEN, Barracuda, SpamCop) or use a multi-list checker. The bounce text often names the list explicitly, e.g. 'listed at spamhaus.org'.
Why does my email pass on Gmail but get 554 from corporate servers?
Corporate mail gateways (Proofpoint, Mimecast, Barracuda) run stricter and different rule sets than consumer providers. They lean heavily on commercial blacklists and content scoring, so a message Gmail inboxes can still trip a 554 at a company gateway.
