Where you saw it: A bounce message with additional text naming a blocklist, an authentication failure, or a policy, immediately after the 5.7.1 code.
Why it happens
- Your sending IP or domain is on a blocklist the receiver queries at connection time.
- DMARC is failing and the domain's policy tells receivers to reject.
- The receiving organization has a rule against your domain, your content or your attachment type.
- Reverse DNS on your sending IP is missing or does not match, which some receivers treat as disqualifying.
- Volume from your IP crossed a threshold that the receiver enforces with a rejection rather than a delay.
The fix, in order
Read the text after the code
The extended message is where the diagnosis lives. It usually names a blocklist with a URL, or says the message failed DMARC, or points at a policy page. That text is the whole investigation.
Check the named blocklist
If the bounce names Spamhaus, Barracuda or another list, look up your IP there. Delisting is a different process for each and the bounce tells you which one to start.
Verify your own authentication
Send a test message to a mailbox you control and read Authentication-Results. A DMARC failure at a receiver on a reject policy produces exactly this code.
Check forward and reverse DNS on the sending IP
The PTR record should resolve to a hostname, and that hostname should resolve back to the same IP. Some receivers reject outright when it does not.
Do not retry into a rejection
A 5xx is permanent. Retrying the same message from the same IP adds another rejection to your record with the receiver and changes nothing.
How to know it worked
The short version
- A test message to the same domain is accepted.
- The blocklist named in the bounce no longer lists your IP.
- Authentication-Results shows spf, dkim and dmarc passing.
Questions people ask
Is 5.7.1 a hard bounce?
It is a permanent rejection of that message, so platforms often classify it as one. It is a policy rejection rather than a nonexistent mailbox, and the address should usually stay on your list.
Why does only one company reject me?
Because filtering policy is set per organization. A corporate gateway can block your domain or your content while every other receiver accepts it happily.
Should I contact the recipient another way?
For a business relationship, yes. Their IT team can allowlist your domain, and that is usually faster than working out which of their rules you tripped.