# SMTP reply codes

> What each SMTP reply code means, whether it's temporary or permanent, how Emailit handles it, and the replies Emailit's SMTP relay sends to your app.

Every SMTP command gets a three-digit reply. This page lists the codes you see in two places: replies from recipients' mail servers when Emailit delivers your mail, and replies from Emailit's own SMTP relay when your app sends through `smtp.emailit.com`.

## How to read a reply

A reply starts with a three-digit code, usually followed by an [enhanced status code](/docs/dictionary/enhanced-status-codes/) and a human-readable message:

```text
550 5.1.1 <ada@example.com>: Recipient address rejected: User unknown
```

The first digit tells you the outcome:

| First digit | Meaning | What the sender should do |
|---|---|---|
| `2` | Success. The command was accepted. | Continue. |
| `3` | Intermediate. The server needs more input, for example the message body after `DATA`. | Send the next part. |
| `4` | Temporary failure. The same command might work later. | Retry later. |
| `5` | Permanent failure. Repeating the command won't help. | Don't retry without changing something. |

The second digit gives the category (`0` syntax, `1` information, `2` connection, `5` mail system), and the third digit narrows it down. Servers often use codes loosely, so always read the enhanced code and the message text too.

## How Emailit handles replies from recipient servers

When a recipient's server answers with a failure, Emailit records a [delivery](/docs/logs/email-details/) with the full reply and decides whether to retry:

- **Bounced immediately.** Replies with code `550`, `551`, `553` or `554`, and replies whose text says the failure is permanent. The email gets the status `bounced`.
- **Retried.** Everything else, including `421`, `450`, `451`, `452`, timeouts and connection errors. The email gets the status `attempted` and Emailit retries up to 7 times over about 21 hours (after 10, 20, 40, 80, 160, 320 and 640 minutes). If every attempt fails, the email is bounced and the address is suppressed.
- **Treated as permanent despite a 4xx code.** Common "mailbox full", "over quota", "user unknown", "mailbox disabled" and "relay access denied" replies are rewritten to a permanent failure, because retrying them rarely works.
- **Back-off.** A `451` reply pauses delivery from that sending IP to that recipient domain for 5 minutes. A `550 5.7.1` block (for reasons other than content) pauses it for 1 hour. Emails that hit a pause are marked `attempted` and retried on the normal schedule.

Hard bounces lead to [automatic suppression](/docs/suppressions/manage/) according to your workspace settings. For causes and fixes grouped by problem, see [Bounce categories](/docs/dictionary/bounce-categories/).

## Reply code reference

"Emailit" describes what happens when a recipient's server sends this code during delivery.

### 2xx and 3xx: success and intermediate

| Code | Meaning | Type | Emailit |
|---|---|---|---|
| `220` | Service ready. The server's greeting, also sent before a `STARTTLS` handshake. | Success | Continues the conversation. |
| `221` | Closing the connection, usually after `QUIT`. | Success | None. |
| `235` | Authentication succeeded. | Success | Not used when delivering to recipients; Emailit's relay sends it to your app after `AUTH`. |
| `250` | Requested action completed. After `DATA`, the server accepted the message. | Success | Marks the email `delivered`. |
| `251` | User not local; the server will forward the message. | Success | Treated like `250`. |
| `252` | The server can't verify the user but will try to deliver. | Success | Treated like `250`. |
| `354` | Start sending the message body; end it with a line containing a single dot. | Intermediate | Sends the message. |

### 4xx: temporary failures

| Code | Meaning | Type | Emailit |
|---|---|---|---|
| `421` | Service not available, closing the connection. Often too many connections or a temporary reputation block. | Temporary | Retried. Mailbox-full and account-unavailable variants are bounced. |
| `450` | Mailbox unavailable, for example busy, locked or greylisted. | Temporary | Retried. Quota, unknown-user and disabled-mailbox variants are bounced. |
| `451` | Local error in processing, often rate limiting or greylisting. | Temporary | Retried, with a 5-minute back-off for that IP and domain. Over-quota and inactive-mailbox variants are bounced. |
| `452` | Insufficient system storage, or too many recipients in one transaction. | Temporary | Retried. Quota, storage and mailbox-full variants are bounced. |
| `454` | Temporary authentication or TLS failure. | Temporary | Retried. "Relay access denied" variants are bounced. |

### 5xx: permanent failures

| Code | Meaning | Type | Emailit |
|---|---|---|---|
| `500` | Syntax error, command not recognized. | Permanent | Retried, then bounced after the last attempt. |
| `501` | Syntax error in parameters or arguments, such as a malformed address. | Permanent | Retried, then bounced after the last attempt. |
| `502` | Command not implemented. | Permanent | Retried, then bounced after the last attempt. |
| `503` | Bad sequence of commands. | Permanent | Retried, then bounced after the last attempt. |
| `504` | Command parameter not implemented. | Permanent | Retried, then bounced after the last attempt. |
| `521` | The domain doesn't accept mail (RFC 7504). | Permanent | Retried, then bounced after the last attempt. |
| `530` | Authentication required, or the server requires TLS first. | Permanent | Retried, then bounced after the last attempt. |
| `534` | Authentication mechanism is too weak. | Permanent | Retried, then bounced after the last attempt. |
| `535` | Authentication credentials invalid. | Permanent | Retried, then bounced after the last attempt. |
| `538` | Encryption required for the requested authentication mechanism. | Permanent | Retried, then bounced after the last attempt. |
| `550` | Mailbox unavailable: the address doesn't exist, or the server refused the message for policy or spam reasons. | Permanent | Bounced. `550 5.7.1` blocks also trigger a 1-hour back-off for that IP and domain. |
| `551` | User not local; the server won't forward. | Permanent | Bounced. |
| `552` | Mailbox full or message exceeds the server's size limit. | Permanent | Retried, then bounced after the last attempt. Known over-quota replies are bounced immediately. |
| `553` | Mailbox name not allowed, for example an invalid address. | Permanent | Bounced. |
| `554` | Transaction failed, often a policy, spam or reputation rejection. Also sent as a greeting when a server refuses the connection. | Permanent | Bounced. |
| `555` | `MAIL FROM` or `RCPT TO` parameters not recognized. | Permanent | Retried, then bounced after the last attempt. |
| `556` | The domain doesn't accept mail (RFC 7504). | Permanent | Retried, then bounced after the last attempt. |

> **Why some 5xx codes are retried:** Emailit bounces immediately only on `550`, `551`, `553` and `554`, or when the reply says the failure is permanent. Other `5xx` replies are retried like temporary failures and bounced after the seventh attempt. The email shows `attempted` in the meantime.

## Replies from Emailit's SMTP relay

When your app sends through `smtp.emailit.com`, these are the replies Emailit can return. Replies to `MAIL` and `DATA` commands on an authenticated connection are also listed in **Email API → Logs** with their status code.

| Reply | Command | Cause | What to do |
|---|---|---|---|
| `235 Authentication successful` | `AUTH` | The API key was accepted. | Continue. |
| `535 Authentication failed` | `AUTH` | The password isn't a valid API key for any workspace. | Use a current API key as the password. The username can be `emailit`. |
| `454 Temporary authentication failure` | `AUTH` | Emailit couldn't check the key because of an internal error. | Retry after a short delay. |
| `504 Error: Unrecognized authentication type` | `AUTH` | Your client used a method other than `PLAIN` or `LOGIN`, such as `CRAM-MD5`. | Set the client to `PLAIN` or `LOGIN`. |
| `452 4.4.5 Messages per second limit exceeded (n/limit)` | `MAIL FROM` | The workspace hit its per-second [sending limit](/docs/limits/). The limit is shared by the API and SMTP. | Slow down and retry. Most mail libraries retry `4xx` replies automatically. |
| `452 4.5.3 Daily message limit exceeded (n/limit)` | `MAIL FROM` | The workspace hit its daily sending limit, which resets at 00:00 UTC. | Wait for the reset or request a higher limit from the dashboard. |
| `451 Temporary local error in processing` | `MAIL FROM`, `RCPT TO`, `DATA` | A temporary problem on Emailit's side. | Retry later. |
| `530 Authentication required` | `RCPT TO` | The client didn't log in before sending. | Enable SMTP authentication in your client. |
| `501 Invalid RCPT TO format` | `RCPT TO` | The recipient address is malformed. | Fix the address. |
| `550 Unverified workspaces can only send to workspace members' account emails.` | `RCPT TO` | The workspace is in [sandbox mode](/docs/workspaces/production-access/) and the recipient isn't a member. | Send to a member's account email, or request production access. |
| `535 Mail server has been suspended` | `RCPT TO` | The workspace is suspended. | Check your sending health and contact support. |
| `530 From/Sender domain is not verified for this workspace. From: ...` | `DATA` | The `From` header isn't on a verified sending domain of the workspace. Subdomains must be verified separately. | [Verify the domain](/docs/domains/verification/) or change the `From` address. |
| `530 API key is restricted to sending domain: acme.com. ...` | `DATA` | The API key is restricted to one domain and the `From` address uses another. | Use the allowed domain or a different key. |
| `550 Sending from this domain is paused` | `DATA` | The domain was paused, usually because of a high bounce rate. | See [Sending health](/docs/deliverability/sending-health/). |
| `552 Message too large (maximum size 40MB)` | `DATA` | The message, including encoded attachments, is over 40 MB. | Send smaller attachments or link to files instead. |
| `550 Loop detected` | `DATA` | The message already passed through Emailit's relay more than 4 times. | Check forwarding rules that send mail back to Emailit. |
| `550 Message processing failed` | `DATA` | Emailit couldn't store the message. | Retry. If it keeps failing, contact support with the time of the attempt. |
| `250 2.0.0 OK: queued as em_...` | `DATA` | Emailit accepted the message. Each recipient gets its own email ID, listed comma-separated when they fit in the reply. | Store the ID to look the email up in the dashboard or API. |

The relay also sends standard protocol replies, such as `220` when you connect, `503 Error: need MAIL command` when commands arrive out of order, and `421 Timeout - closing connection` when a connection sits idle.

> **Inbound mail:** When Emailit receives mail for your [inbound subdomain](/docs/inbound/set-up/) and the workspace has no credits left, the sending server gets `452 Insufficient credits to receive inbound email` and retries later.

## Related

- [Enhanced status codes](/docs/dictionary/enhanced-status-codes/)
- [Bounce categories](/docs/dictionary/bounce-categories/)
- [SMTP settings](/docs/smtp/settings/)
- [SMTP troubleshooting](/docs/smtp/troubleshooting/)

---
Source: https://emailit.com/docs/dictionary/smtp-reply-codes/