SMTP error 550 5.1.0: sender address rejected

SMTP error 550 5.1.0 is a permanent rejection of the sender's address - your MAIL FROM,

not the recipient's RCPT TO. The enhanced code 5.1.0 is RFC 3463's generic "other address

status" in the addressing family; receiving servers use it when the problem is with an address but

does not fit a more specific sub-code like 5.1.1 (unknown mailbox) or 5.1.8 (bad sender

system).

Fault: sender, specifically the envelope sender's domain or format, not the message content

or the recipient.

Why it happens

• The sending domain in `MAIL FROM` has no valid DNS record. Many receivers run

reject_unknown_sender_domain-style checks: if yourdomain.com has no MX and no A/AAAA

record, some strict receivers reject at MAIL FROM immediately, before the recipient is ever

considered.

• A null or malformed envelope sender outside the one case where it is valid. `MAIL

FROM:<>` is legitimate only for bounce (non-delivery) messages; a real outbound message sent

with an empty envelope sender is rejected by policy on many receivers.

• The envelope-from domain differs wildly from anything else about the connection, which some

receivers treat as a forgery signal even without a specific SPF failure being checked yet.

• The sending domain is on the receiver's own local sender denylist, distinct from a public

blocklist - some enterprise mail systems maintain an internal list independent of Spamhaus or

similar services.

• A previous owner of the domain left behind a poor sending history that a receiver's local

policy has not yet forgotten, even though the current owner has never sent anything

objectionable from it themselves.

The transcript

$ swaks --to test@mailpilots.in --from sender@newly-registered-domain.test \
        --server mx.example.net
-> MAIL FROM:<sender@newly-registered-domain.test>
<- 550 5.1.0 Sender address rejected: Domain not found

Note this fails at MAIL FROM, before RCPT TO is ever sent - the recipient address was never

evaluated, and nothing about this error is the recipient's fault.

How the big three word it

Diagnose it

$ dig +short MX yourdomain.com
$ dig +short A yourdomain.com

If both commands return nothing, the sending domain genuinely has no DNS presence for mail, and

any receiver checking for one will reject you exactly this way.

$ dig +short MX yourdomain.com
mail.yourdomain.com.
$ dig +short A mail.yourdomain.com
203.0.113.10

If records exist but the rejection persists, check DNS propagation and TTLs - a very recently

created domain can still be resolving from a stale negative-cache entry at some resolvers.

The fix, in order

1. Confirm the sending domain has at least one of an `MX` or `A` record, with dig, from an

external resolver (not your own DNS server, to rule out split-horizon surprises).

1. Never send real outbound mail with a null envelope sender. Reserve MAIL FROM:<> for

actual bounce messages generated by your own MTA.

1. Check DNS propagation if the domain is new. Allow standard TTL-based propagation time

before assuming the record itself is wrong.

1. Verify the envelope-from domain matches what you intend to send as - some application

misconfigurations set a placeholder or test domain in the envelope sender that never got

corrected for production.

1. If a specific large receiver persists in rejecting a domain with valid DNS, contact their

postmaster address; this can indicate the domain or a previous owner's history is on an

internal denylist.

What not to do

• Do not focus on the recipient address. The transaction never reached RCPT TO; nothing

about the recipient is involved.

• Do not add SPF/DKIM records expecting this specific error to clear. 5.1.0 is a DNS/format

check on the domain's existence, not an authentication check - those are different, later

stages of validation.

• Do not switch to a different recipient to "test around" the error. It will fail identically

for every recipient at the same receiving system, since the rejection happens before any

recipient is named.

• Do not use a placeholder or internal-only domain as your envelope sender in any environment

that sends real mail, including staging environments that occasionally leak real recipients.

MailPilot checks a sending domain's core DNS records - including MX and the authentication

trio of SPF, DKIM, and DMARC - as part of its Domain Health checks, catching a missing or

misconfigured record before it produces a 550 5.1.0 against a real recipient.