When an email fails, the mail server records why — in the Result column of cPanel's Track Delivery report, and in the bounce message sent back to the sender. Both carry the same text, and it is rarely written for a human reader.
This article is a lookup. Find the wording you are seeing, read what it means, and act. If you have not yet found the failing message, start with How to Trace Email Delivery in cPanel, which explains how to run the report.
How to Read Any Result Message
Before hunting for your exact string, three quick reads tell you most of what you need. The wording varies between mail server versions, so match on the shape rather than character-for-character.
1. Who is speaking? If the text names a remote host with its IP address in square brackets, the recipient's provider spoke and the decision was theirs. If no remote host is named, your own server produced the message before any remote contact happened.
2. At what point did it fail? Two wrappers do most of the work:
SMTP error from remote mail server after RCPT TO:<address>— refused at the address stage. Usually a wrong or closed address, a policy block, or relaying denied.SMTP error from remote mail server after end of data— refused after the whole message was sent. That points to content, authentication or sender reputation, almost never a bad address.LMTP error after end of data— the local delivery step failed. This is a mailbox on this server, not a remote one.
| Code family | Meaning | Status you will see |
|---|---|---|
| 4xx (421, 451, 452) | Temporary. The receiving server asked us to try later. | Deferred — still queued, and usually still arrives |
| 5xx (550, 552, 554) | Permanent. The receiving server refused outright. | Error — gone, and bounced back to the sender |
Note: Long replies from remote servers can appear cut off in the Result column, because the stored failure text is length-limited. If a string ends mid-sentence, quote what you can see and tell us it was truncated — we can retrieve the full line from the raw mail log.
Errors Your Own Server Produced
No remote host is named in these. They are the ones you or Cynet can act on directly.
| Result text | What it means | What to do |
|---|---|---|
Unrouteable address | The server ran out of ways to route the address. On a cPanel server this usually means the domain is treated as local but no matching mailbox, forwarder or alias exists. | Confirm the mailbox exists (see creating an email account) and check Email Routing for the domain. |
Sender verify failed | The message was refused because the sending address could not be verified — classic after a migration where the From address was never recreated. | Send from an address that actually exists on the account, or recreate it. |
552 5.2.2 Mailbox is full / Blocks limit exceeded / Inode limit exceeded, inside an LMTP error wrapper | A local mailbox could not be written to. These three cover different causes: the mailbox quota, the account's total disk quota, and the account's inode count. | Check all three. Clear space with Email Disk Usage and see Fix: Disk Quota Exceeded. |
mailbox is full (MTA-imposed quota exceeded while writing to tmp/...) | The same condition reported by the mail server rather than the mailbox server. Which form you see depends on the server's delivery path. | As above. |
... has an outgoing mail hold. Message will be reattempted later. | The account or domain is under an outgoing mail hold. "Will be reattempted later" is literal — the mail is queued, not lost. | Follow Fix: Outgoing Mail Hold. If the hold was applied server-side, ask us to release it. |
... has exceeded the max emails per hour ... Message discarded. | The hourly sending limit was hit. Note Message discarded — this one really is gone. | Stop the sending source, then read Fix: Outgoing Mail Hold for causes and prevention. |
... has exceeded the max defers and failures per hour ... Message discarded. | A percentage limit, not a volume limit — your own bounces triggered it. Ten messages with five failures is 50%, enough to trip a 50% limit. | The block clears at the top of the next hour. The fix is list hygiene, not a bigger limit: remove dead addresses. |
too many recipients (usually with 452, sometimes 552 or 554) | Too many recipients on one message. By default the surplus recipients are deferred; on some configurations they fail permanently. | Split the recipient list across several messages, and ask us if you need the server-side limits checked. |
| A 4xx deferral on incoming mail from an unfamiliar sender | Greylisting — the server asks a first-time sender to try again shortly. Affects incoming mail only, never your own outgoing mail. | Nothing. Legitimate senders retry automatically, usually within minutes. |
Errors the Recipient's Server Produced
These arrive wrapped in SMTP error from remote mail server after ..., naming a hostname and IP. You cannot change another provider's policy; what you can change is your authentication, your sending volume, and the address you are writing to.
| Code and text | Meaning | Next action |
|---|---|---|
550 5.1.1 The email account that you tried to reach does not exist. (Gmail), 554 ... This user doesn't have a yahoo.com account | The address is wrong or closed. Permanent. | Check the spelling with the recipient. |
550 5.7.26 — "the sender is unauthenticated", or "not accepted due to domain's DMARC policy" | Your domain is not authenticating. Permanent, and it affects every message to Gmail. | Fixable, and on your side: repair your SPF and DKIM records. |
550 5.7.27 ... didn't pass SPF authentication | SPF specifically. Permanent. | Same fix — repair SPF and DKIM. |
550 5.7.25 ... the sending IP address doesn't have a PTR record | Reverse DNS on the sending IP. Permanent. | You cannot set this yourself. Open a ticket and we will correct the reverse DNS for the mail IP. |
550 5.7.1 ... part of their network is on our block list (S3150) (Microsoft; also seen as S3140) | Microsoft has blocked a network range, not your domain or your reputation. | You cannot fix this. Follow Fix: Email to Hotmail/Outlook Blocked and open a ticket — we submit the delisting request. |
550 5.7.1 Service unavailable, Client host ... blocked using Spamhaus | The sending IP is on a Spamhaus list. Permanent until delisted. | Open a ticket. Delisting requires the spam source to be fixed first — if that was your own account, see Email Account May Be Compromised. |
552 5.2.2 The recipient's inbox is out of storage space | The recipient's mailbox is full. Permanent. | Nothing you or we can do. Contact the recipient another way. |
421 4.7.28 ... unusual rate of email ... temporarily rate limited (Gmail), 421 4.4.2 Message submission rate ... exceeded (Microsoft), 421 4.7.0 [TSS04] ... temporarily deferred (Yahoo) | Rate or reputation throttles. All 4xx: deferred, not failed. The mail is queued and usually gets through. | Stop sending in bulk and let the queue drain. Do not resend manually — that makes it worse. |
554 5.7.9 Message not accepted for policy reasons. or 554 ... [PH01] Email not accepted for policy reasons. | A content or reputation block. Permanent. | Review the message content and your authentication. Yahoo labels content blocks with a PH code and deferrals with a TS code. |
Errors from the Routing and DNS Layer
No remote host is named in these either, because the failure happened before or during the attempt to find the recipient's mail server.
| Result text | What it means | Next action |
|---|---|---|
host lookup did not complete | DNS lookup for the recipient's domain did not finish. Temporary, so Deferred. | Wait. If it persists, the recipient's DNS is broken — tell them. |
all relevant MX records point to non-existent hosts | The recipient domain's MX records point at IP addresses instead of host names, which is invalid. Permanent. | Nothing on your side. Their DNS administrator must fix the MX records. |
lowest numbered MX record points to local host or remote host address is the local host | The server was told to deliver remotely but the address resolves back to itself. On cPanel this is nearly always an Email Routing mismatch — the domain is set to Local Mail Exchanger while its MX points elsewhere, or the reverse. | Open Email Routing and set the domain to match where the mailboxes actually live. Check the MX records first — see Understanding DNS Records. |
an MX or SRV record indicated no SMTP service | The recipient domain publishes a "null MX", declaring it never accepts mail. Permanent by design. | The address is unusable. Find another contact route. |
retry time not reached | An earlier attempt failed temporarily and the next scheduled attempt has not come round yet. Deferred. | Wait. Persisting for days means the recipient's server is genuinely down. |
Connection refused / Connection timed out | The recipient's mail server refused the connection, or never answered. Deferred, retried on schedule. | Wait. If it persists, tell the recipient their mail server is not accepting connections. |
| A TLS or encryption error | The encrypted handshake with the recipient's server failed, usually appearing as Deferred. Exact wording varies by version, so do not match on a fixed string. | Wait one retry cycle, then open a ticket quoting the message ID. |
How Long a Deferred Message Keeps Trying
A Deferred result is not a lost message. On a standard cPanel configuration the mail server retries roughly every 15 minutes for the first two hours, then at widening intervals, then every few hours — giving up about four days after the address first started failing, at which point the message bounces back to the sender.
Two honest caveats:
- Retry times are hints, not promises. The server does not run deliveries at exactly the computed times, and the practical minimum gap is however often the queue runner runs.
- The four-day clock belongs to the address, not the message. It measures continuous failure for that recipient, so a message sent into an already-failing address can bounce sooner than four days after you sent it.
If Your Error Is Not Listed
Mail servers produce far more error text than any list can cover, and providers reword theirs regularly. If you cannot find your string here:
- Apply the three reads at the top — who spoke, at what stage, and 4xx or 5xx. That alone tells you whether to wait or to act.
- Search the exact three-digit code plus any bracketed reference (
S3150,TSS04,PH01). Providers publish their own code lists. - If the message is a permanent failure you cannot explain, open a ticket at manage.cynet.com.my.