[ Troubleshooting & reporting ]
SMTP, headers and delivery errors
Decode bounce codes and message headers, and fix the authentication failures behind them.
47 guides
[ All guides ]
Article
What is 550-5.7. 26 Error and How to Resolve it?
I am getting 550-5.7.26 error from Gmail. I need step-by-step solutions for SPF, DKIM, and DMARC setup to ensure my emails are delivered.
Guide
550 5.1.1 responses: separate an invalid recipient from a domain-authentication problem
Verify the intended recipient and receiving-system evidence before treating a 550 5.1.1 response as a DNS authentication problem.
Guide
Authentication-Results headers and the trust boundary
Authentication-Results is a report from a verifier, not a self-authenticating certificate; trust depends on the receiving system’s boundary handling.
Guide
Backscatter: why a bounce can involve a forged sender address
An unexpected bounce can be collateral damage from someone forging your envelope address; correlate it before treating it as proof of account compromise.
Guide
Build a repeatable email-delivery incident evidence pack
Build an incident pack that another analyst can reproduce, with originals, derivatives, a timeline and explicit limits on what was observed.
Guide
Catch-all mail domains: why validation tools can disagree
Catch-all behavior makes recipient probes ambiguous; disagreements between validators often reflect different tests rather than a definitive list of real mailboxes.
Guide
Compare sender logs, receiver diagnostics and DMARC reports
Reconcile sender transactions, trusted receiver evidence and DMARC aggregate reports without confusing their stages, populations or timestamps.
Guide
Delayed bounce messages and messages already retried
Reconcile the original queue, later notification and any replacement submission before retrying again or declaring a delivery repaired.
Guide
Delivery Status Notifications: trace the original failure and reporting system
Read the recipient-specific DSN fields to distinguish the reporting relay from the system and event that actually caused delivery failure.
Guide
DKIM verification of a saved message versus the original delivery
Reverify saved bytes with explicit key provenance, and do not confuse a current local result with the original receiver’s decision.
Guide
Email accepted by SMTP but not visible in the inbox
Trace a final SMTP acceptance through receiving-side processing before calling a missing inbox message a sender-authentication failure.
Guide
Enhanced SMTP status codes: read the complete diagnostic message
Decode enhanced SMTP status codes alongside the basic reply, command, recipient and original diagnostic.
Guide
Forged authentication-result headers: what an analyser should ignore
A header analyser should ignore untrusted authentication claims for its security verdict, while preserving them as evidence of what the message contained.
Guide
From, Sender and Reply-To differences: investigate the business context
From, Sender and Reply-To describe different message roles; interpret differences against the approved workflow rather than treating equality as authentication.
Guide
Gmail 5.7.26: diagnose the returned reason before changing DNS
Read the complete bounce text, identify the failed identity and retest the specific sending route.
Guide
Gmail rate-limit responses: preserve the queue and retry carefully
Handle Gmail rate-limit responses with complete diagnostics, response-aware backoff, one queue owner and a fictional timeline that keeps evidence gates open.
Guide
Google message headers and original-message authentication evidence
Capture Gmail’s original-message evidence without confusing a summary label, a forwarded copy and a fresh authentication test.
Guide
Invalid domain-name errors: separate syntax, DNS existence and SMTP identity
Classify a domain-name error as syntax, DNS resolution, mail routing or SMTP policy before applying a fix.
Guide
List-ID and mailing-list evidence in a message
Use List-ID as a stable list identifier while checking authentication and route evidence separately.
Guide
List-Unsubscribe and List-Unsubscribe-Post headers
Distinguish a list-management link from the signed one-click unsubscribe mechanism, and test without unsubscribing real recipients.
Guide
Mailbox-full responses and their effect on retry handling
Keep a capacity refusal separate from sender authentication, and let its actual SMTP class and queue state govern the next attempt.
Guide
Masked external SMTP banners: interpret scanner warnings
Interpret a masked SMTP banner as a limited visibility finding and test actual protocol behavior before changing the gateway.
Guide
Message-ID domains: why they do not prove sender ownership
A Message-ID is a correlation identifier, not evidence that its domain owner sent or approved the message.
Guide
Message-size rejections versus authentication rejections
Measure the complete transmitted message and locate the rejecting limit before changing authentication or repeatedly resending an oversized attachment.
Guide
Microsoft composite authentication results and DMARC
Interpret Microsoft compauth values and reason codes alongside, rather than in place of, DMARC and trusted original-message evidence.
Guide
Microsoft policy blocks versus authentication failures
Classify Microsoft delivery refusals using the full response, service, sending route and recipient class rather than treating every policy code as authentication failure.
Guide
Outlook 550 5.7.515: verify the domain’s sender requirements across every service
Investigate the Microsoft consumer-service rejection using the full response and a domain-wide sender inventory.
Guide
Port 25 filtering and its effect on self-hosted mail
Confirm whether outbound port 25 is restricted before changing DNS, and choose an authorized direct-delivery or relay architecture.
Guide
RCPT TO checks and mailbox existence: understand the evidence limits
A response to RCPT TO describes one server’s handling of one recipient command; it is not a reliable directory lookup or proof of delivery.
Guide
Read an email header using trusted receiving-system evidence
Start with provenance and the receiving boundary, then connect identities, authentication results and transport events without treating every header as a fact.
Guide
Received headers: reconstruct the route without trusting every claimed hop
Received fields show a claimed transport history; reconstruct only the portion supported by trusted receiving systems and corroborating logs.
Guide
Redact an email sample without destroying the evidence needed for diagnosis
Keep an untouched original and create a purpose-specific sanitized copy, with an explicit record of what the edits can no longer prove.
Guide
Return-Path headers and the actual SMTP envelope
Return-Path records the envelope return address at delivery, but it is not the visible author and cannot be trusted without knowing how the message was obtained.
Guide
Safely share bounce and header evidence with a supplier
Prepare a purpose-limited supplier evidence package that preserves diagnostic relationships while minimizing personal information, secrets and unnecessary content.
Guide
SCL, BCL and other Microsoft verdicts: distinguish them from authentication results
Distinguish authentication evidence from Microsoft spam, bulk and policy classifications before deciding what to fix.
Guide
SMTP AUTH versus SPF, DKIM and DMARC
Diagnose submission login, transport authorization and domain authentication as separate controls with separate evidence.
Guide
SMTP banner and reverse-DNS mismatches
Compare the SMTP greeting, EHLO identity, forward DNS and PTR evidence without treating a hostname mismatch as a complete authentication verdict.
Guide
SMTP connection timeouts and unavailable MX hosts
Separate name resolution, TCP connection, SMTP greeting and later command timeouts before deciding that an MX host is unavailable.
Guide
SMTP envelope and message headers: identify which system supplies each value
Map each envelope value, message header and authentication verdict to the system that supplied it and the boundary that makes it trustworthy.
Guide
SMTP explained through a complete mail-delivery transaction
Read an SMTP conversation by stage and recipient, preserving the response that transfers responsibility for the message.
Guide
SMTP HELO and EHLO names: distinguish identification from authentication
Use HELO and EHLO as SMTP identification and capability signals, then evaluate authentication and policy separately.
Guide
SMTP relay denied: find the rejected route or permission
Diagnose SMTP relay-denied responses by endpoint, full code, stage, sender permission and connector attribution without blind retries or unsafe relay changes.
Guide
SMTP relay versus Direct Send: inventory application mail
Inventory application mail by endpoint, permission, sender identity and recipient scope, distinguishing Microsoft SMTP relay, submission and Direct Send.
Guide
SMTP temporary and permanent failures: choose the right investigation
Use the SMTP reply class, failure stage and queue history to decide whether to retry, repair or investigate an uncertain delivery.
Guide
SMTP TLS handshake failures during delivery
Locate the failed TLS stage and applicable transport policy before deciding whether a delivery connection can safely continue.
Guide
SMTP, IMAP and POP3: distinguish delivery from mailbox access
Locate a mail problem in submission, server transfer, mailbox storage or client access before changing authentication settings.
Guide
Yahoo deferrals and policy blocks: collect the evidence support needs
Collect Yahoo response text, queue timing, route and per-recipient outcomes before selecting a scoped remediation or support request.
Related free tools
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption
[ More in Troubleshooting & reporting ]