What the receiver is telling you

Two different situations share this code. The common one for senders is DMARC: the From domain publishes p=reject or p=quarantine, and this message failed both SPF alignment and DKIM alignment, so the receiver did what the policy asked. The other is a server telling you it needs SMTP authentication — you connected to a submission port as if it were an inbound MX, or your relay's credentials are wrong. The wording distinguishes them.

Why a policy block must not be treated as a bad address

Sending tools file every 5xx under "bounced", and the natural reflex is to scrub the address. For a policy block that is exactly wrong. The recipient exists and would have received the mail; the receiver refused it because of your domain, IP, authentication or content. Scrubbing throws away a lead and leaves the cause in place, so the next send produces the same block against the next thousand addresses. The right response is to stop sending from the affected domain, find what the receiver named, fix it, and resume at low volume.

What to do

1. DMARC wording: check the message's alignment. The usual fault is the sending tool signing with its own DKIM domain while the From is yours — add a DKIM key on your domain and sign with it.
2. Check the DMARC record's aspf and adkim tags; a strict setting turns subdomain sending into a failure.
3. Authentication-required wording: your relay or tool is connecting to the wrong port or with wrong credentials. Nothing to do with the recipient.

don't Do not lower the DMARC policy to make the bounces stop. Fix alignment and the bounces stop on their own.

Decode the whole bounce

Paste the complete failure notice — every code and the receiver's wording — and get each part explained together.

Common questions