Read SMTP reply codes

Every SMTP reply starts with three digits. The first digit tells you almost everything you need:

• 2xx success, the command worked
• 3xx keep going, the server wants more (you saw 354 after DATA)
• 4xx temporary failure, try again later
• 5xx permanent failure, don’t retry this as-is

That last distinction drives all sending software. After a 4xx the sender queues the message and retries. After a 5xx it stops. Repeating the same message forever after a 5xx achieves nothing. Something has to change: the address, the content, or the route.

Enhanced status codes

Most servers add a second code after the first, like 5.1.1. These are enhanced status codes, and they’re more precise. 5.1.1 always means “bad destination mailbox”. The plain 550 could mean several things.

Read the text too. It’s useful for humans. But automate decisions from the codes, because the wording changes from one server to the next.

The command matters as much as the code

The same reply means different things at different points in the conversation:

S: 451 4.7.1 Try again later
S: 550 5.1.1 Mailbox unavailable
S: 552 5.3.4 Message too large

A 451 during RCPT TO defers one recipient. A 552 after DATA rejects the content for everyone. When you log a failure, record four things together: the command, the reply code, the enhanced code, and the remote hostname. Any one of them alone is hard to act on.

Not every 4xx means “down”

Be careful with 4xx. It doesn’t mean the server is offline. Some common causes:

• greylisting, where a server rejects the first attempt from an unknown sender on purpose and accepts the retry
• rate limits, because you sent too fast
• a full mailbox
• a temporary DNS hiccup on their side

The right response is to back off with increasing delays. A tight retry loop makes their temporary problem worse and gets you rate-limited harder.

Not every 5xx means “never”

A 5xx is permanent for this attempt with these parameters. It is not a verdict on the address.

A 552 for a 30 MB attachment goes away if I send a link instead. A 550 5.7.1 Relay access denied means I connected to port 25 without authenticating. Sending through the correct submission port with credentials fixes it.

Try this with the three replies above. For each one decide: queue it, change the message, change the route, or tell the sender. Write down which piece of evidence led you there.