Short answer
554 5.7.1 means the receiving server refused your message for a security or policy reason. RFC 5321 defines 554 as "transaction failed" (and, as a greeting, "no SMTP service here"); the enhanced code 5.7.1 is "delivery not authorized, message refused". In practice it's the same family as 550 5.7.1, and servers pick one or the other by habit.
The common causes are a relay the server won't allow ("Relay access denied"), a blocklisted sending IP or domain, content a spam filter rejected, or failed authentication. It's about the sender, so don't suppress the address; fix the cause the text names.
On this page
What 554 5.7.1 means
554 is the most general permanent failure in SMTP. Some servers use it at the start of a connection to say they won't talk to you at all, others after the message data to say they won't take this message. Paired with 5.7.1, it says the reason is policy: the server decided you aren't authorized to deliver this.
Common causes, by receiver
| Where you see it | Typical text | What it points to |
|---|---|---|
| Many self-hosted and corporate servers | "Relay access denied" | You sent to a server that isn't the destination for that domain, without authenticating. Often an app pointed at the wrong SMTP host, or missing SMTP credentials. |
| Servers that check DNS blocklists | "Service unavailable; Client host [IP] blocked using" a named list | The sending IP or domain is listed. |
| Yahoo and AOL | 554 with a policy, authentication or content reason | Yahoo uses 553 and 554 for permanent problems: invalid recipients, DMARC or DKIM failures, content that breaks its policies, and Spamhaus listings. |
| Corporate filters (gateway appliances and cloud filters) | "Message rejected as spam" or a policy name | The recipient organization's filter scored the message as spam or matched a rule. |
Basic and enhanced meanings from RFC 5321 and RFC 3463; Yahoo from its SMTP error codes page.
How to fix it as a sender
- 1
If it says relay access denied
Check that your app sends through your email provider's SMTP host with credentials, not straight to the recipient's server or to a server that doesn't know you. For Groundmail that's
smtp.groundmail.devon port 587 with an SMTP credential. - 2
If it names a blocklist
Look up the IP and domain with the blocklist checker, fix whatever caused the listing (a compromised account, a bad list, a spike), then request removal.
- 3
- 4
If it's about content
Run a test send through the email spam test. Look for link shorteners, mismatched link domains, image-only messages and URLs on blocklists.
Retry or suppress?
How Groundmail handles 554 5.7.1
Groundmail reads the receiver's whole reply, not only the code. When a 554 5.7.1 reply says the refusal is about the sender (a blocklist listing, a reputation or spam-policy block, or Gmail's authentication and unsolicited-mail refusals), the bounce is recorded with bounce_type: "block". The address is fine, so it is not suppressed and the bounce doesn't count toward your bounce rate; you can send to it again once the cause is fixed. The receiver's reply is in bounce_reason on the email and on the email.bounced or email.failed webhook, so you can see exactly what it said.
Blocks on our shared IPs are our job: we monitor the pool and its listings and work with mailbox providers and blocklist operators to clear them. Blocks caused by your own domain (missing authentication, a DMARC policy your mail fails) need a DNS fix on your side, and the domain page in the dashboard shows the status of each record.
A 554 whose text says the recipient doesn't exist is the exception: Groundmail records that as a hard bounce and suppresses the address, as it would a 550 5.1.1.
Frequently asked questions
What's the difference between 550 5.7.1 and 554 5.7.1?
Very little in practice. Both carry the enhanced code 5.7.1, delivery not authorized. 550 is "mailbox unavailable" and 554 is "transaction failed"; which one a server uses is mostly a matter of how it was built. Read the text that follows to find the cause.
Why does 554 5.7.1 say relay access denied?
The server you connected to isn't responsible for the recipient's domain and you didn't authenticate, so it refuses to pass the message on. Send through your provider's SMTP relay with credentials.
Should I remove the address after a 554 5.7.1?
Usually not. Unless the text says the recipient doesn't exist, the refusal is about the sender, and the address can receive mail once the cause is fixed.
What's the difference between a soft bounce and a hard bounce?
A soft bounce is a temporary failure, usually a 4xx reply (mailbox busy, rate limited, try again later); the sending server retries it. A hard bounce is a permanent failure, a 5xx reply, where retrying the same message won't help. Among hard bounces, it matters whether the problem is the address (unknown user: suppress it) or the sender (a block: fix the cause, keep the address).
Sources
Facts on this page about other companies' products, prices and policies come from these public pages. They change, so check them before you decide.