Validate SMTP Rejection Codes from DSN Headers in Mailgun 2026

Why ignoring Mailgun's DSN SMTP rejection codes hurts your deliverability

You’re sending transactional emails through Mailgun. A bounce comes back. You see “failed” in your dashboard and move on. But behind that single word is a precise SMTP rejection code buried in the DSN header. Ignoring it is like diagnosing a car failure by reading only “engine stopped”—no clue whether it’s a dead battery, a seized piston, or a flat tire.

Mailgun’s DSN headers include full SMTP rejection codes—like 550 (user unknown), 421 (temporarily unavailable), or 552 (message too large)—that tell you exactly what went wrong. Without decoding these, you treat every bounce the same: blacklist, retry, or ignore. But some codes indicate temporary issues that resolve in minutes. Others point to permanently invalid addresses. When you can’t tell the difference, you hurt your sender reputation, waste sends, and increase blacklisting risk.

Key takeaways

• Mailgun’s DSN headers contain SMTP rejection codes that reveal the true reason an email failed
• Mistaking permanent bounces (like 550) for temporary ones (like 421) leads to unnecessary retries and reputational harm
• Validating DSN SMTP rejection codes in real time improves inbox placement and reduces blacklist exposure

What SMTP rejection codes in DSN headers actually mean

SMTP rejection codes in DSN headers are your email delivery system’s way of telling you exactly why an email failed. Codes like 550 (user unknown), 551 (mailbox not found), 552 (message too large), and 553 (not allowed) are not interchangeable — each signals a different, specific reason for failure. Understanding them prevents you from treating temporary issues as hard bounces, which distorts list hygiene and wastes send volume.

550: Permanent Rejection — Known Invalid or Blocked

A 550 code means the recipient’s server permanently rejected the email. It usually means the email address doesn’t exist, the domain is blocked, or the sender is unauthorized. Think of it as a digital "no entry" sign. If you see this in a DSN report from Mailgun, the address should be removed from your list immediately.

551: Mailbox Not Found, Will Not Accept Mail

A 551 response indicates the recipient’s mailbox was not found — and won’t accept mail, even temporarily. This often happens when an email address is deleted or never existed. Unlike a soft bounce, this is not retryable. You shouldn’t reattempt delivery to such addresses. It’s a clean signal to scrub them from your campaign list.

552: Message Too Large

When a 552 code appears, the message body or attachments exceeded the receiving server’s size limit. This isn’t the recipient’s fault — it’s a technical limitation of the mail server. If you’re sending large files, this is a red flag. It’s not a hard bounce in the traditional sense, but if left unaddressed, it can lead to repeated rejections.

553: Domain or Address Not Allowed

A 553 rejection means the recipient’s domain or email address is explicitly blocked. This could be due to policy (e.g., internal corporate rules) or spam filtering. Sometimes, it reflects a domain that blocks all non-verified sends. The key takeaway: this is not a delivery failure you can fix with retries. It’s an enforced restriction.

SMTP codes like these are standardized in RFC 5321 and RFC 6521. They’re designed to allow systems to act on specific, known reasons for failure. Misreading them — like treating a 550 as a temporary issue — leads to poor list hygiene. That’s why validating email addresses in bulk before sending is key. You can catch invalid or permanently rejected addresses early. For example, bulk verification tools use known SMTP standards to flag 550 and 551 failures before they happen. Learn how to clean your list at scale: clean your list with bulk email validation.

How to extract and parse DSN headers from Mailgun’s bounce notifications

You can extract and parse DSN headers from Mailgun’s bounce notifications by retrieving the X-Mailgun-DSN field from inbound webhooks or raw email logs. This field contains a full RFC 3463-compliant DSN, including SMTP status codes like 550 and diagnostic codes like mailboxnotfound. Parsing these fields allows you to classify bounces accurately—whether the issue is a rejected address, a full mailbox, or a temporary failure.

Step-by-step: How to process the DSN data

1. Capture the X-Mailgun-DSN header from your bounce webhook payload or raw log output. Mailgun includes the full DSN in this field, which is the standard mechanism for reporting delivery failures.
2. Parse the DSN using an RFC 3463-compliant parser. The DSN follows an email-specific format defined in RFC 3463, with structured elements like status, diagnostic-code, and final-recipient. Tools like Python’s email module or specialized DSN parsers can handle the parsing.
3. Extract the SMTP status code (e.g., 550) from the status field. This indicates the nature of the rejection—permanent (5xx) or temporary (4xx). A 550 means the recipient’s mailbox doesn’t exist or is blocked.
4. Identify the diagnostic code (e.g., mailboxnotfound, userunknown, blocked). These codes come from the receiving server and help distinguish between hard bounces and soft, recoverable issues.
5. Link the failure context to the original recipient using the final-recipient field. This ensures you know which email address triggered the failure and can act on it.
6. Classify the bounce based on status and diagnostic codes. Use this data to flag permanently invalid addresses, update your list hygiene, and improve long-term deliverability.

Why this matters for deliverability

Without parsing DSN headers, you're left guessing. A generic "bounce" without context keeps invalid addresses in your list, hurting sender reputation and triggering blocklists. Accurate classification lets you remove hard bounces instantly, reduce rejections, and maintain a clean sender profile. This is a core part of maintaining inbox placement—especially important when sending at scale.

For teams managing high-volume sends, automated DSN parsing prevents manual triage. It integrates into your workflow so you can clean lists in real time, improve deliverability, and avoid throttling from providers like Mailgun, SendGrid, or Amazon SES.

If you're building this from scratch, consider using a third-party tool to handle the validation logic. Bulk email list cleaning with a reliable API can help you pre-validate addresses before sending, reducing the number of bounces—and the need to parse DSNs entirely.

Mapping common SMTP rejection codes to email verification verdicts

When Mailgun sends a DSN with an SMTP rejection code, you can translate it directly into a verification verdict: 550 userunknown means the address is invalid and should be purged. 551 notfound or nomailbox is the same—remove it. 552 overquota or mailboxfull means the inbox is full but may open later—mark as risky. 553 notallowed suggests domain-level restrictions—flag as risky if the domain is known. 4xx codes indicate temporary issues—no action needed now. These mappings let you automate cleanup with precision.

Specific SMTP codes and their real-world impact

• 550 userunknown — The mailbox doesn’t exist. This is definitive. Remove the address immediately. No retries. You won’t get a better result later.
• 551 notfound or nomailbox — Similar to 550: the destination is invalid. These are persistent failures. Do not retry. These addresses harm deliverability if you keep them.
• 552 overquota or mailboxfull — The inbox is at capacity. This is temporary, but not a failure you can resolve via resends. Mark as risky—you may see success later, but only after the user clears space.
• 553 notallowed — Often due to domain policies like blacklists, sender restrictions, or non-delivery rules. These are not the user’s fault. If the domain is known (e.g., corporate or role-based), flag it as risky—potential for delayed or blocked delivery.
• 4xx codes (e.g., 450, 451, 452) — These are soft bounces: temporary issues like server overload, rate limiting, or DNS timeouts. They don’t indicate address invalidity. No action is needed now. Let your system retry or wait.

Why this matters for deliverability

Rejection codes are your signal. Acting on them improves sender reputation, reduces spam complaints, and lifts inbox placement. You’re not just cleaning lists—you’re building compliance.

“Each SMTP rejection code tells a story. Ignoring them is like using a car with faulty diagnostics.” — RFC 3463 on DSNs

To automate this mapping at scale, integrate with a real-time verification API that parses DSNs and returns structured verdicts—like real-time email verification tools that support Mailgun’s DSN format. This cuts manual work and ensures consistent cleaning across every send.

For teams managing bulk lists, use bulk email list cleaning with full DSN analysis. It flags bad addresses before they hit your sender reputation or your inbox placement metrics.

Why static list cleaning tools fail to validate DSN rejection codes accurately

You can’t validate SMTP rejection codes from DSN headers in Mailgun 2026 with most list cleaning tools because they don’t analyze the actual SMTP-level response codes—just treat all bounces as equal. Tools that only report a “bounce rate” ignore the difference between a hard failure like 550 (user unknown) and a temporary issue like 551 (user not local), leading to incorrect list pruning. When you don’t decode these codes precisely, you either purge valid addresses or keep dead ones, both of which hurt deliverability over time. Let’s be clear: DSN headers carry SMTP-level response codes—like 550, 551, 4xx, or 2xx—that tell you exactly what happened at the mail server level. A 550 means the recipient doesn’t exist. A 551 means the user was temporarily relocated. A 4xx means it’s a transient failure. Many third-party list validation services don’t inspect this, just score the bounce and move on. That’s why your list might look clean after validation but still sees inbox placement drop—because you didn’t account for nuanced reasons behind bounces.

Why treating bounces as identical is a flaw

When a tool classifies all bounces the same, you lose critical context. A 550 is permanent. A 451 (temporarily rejected) should not trigger removal. A 551 might mean the user moved, but they could return. Many tools lump these together because their process runs on stored data or batch analysis, not real-time SMTP inspection. This leads to over-cleaning: removing addresses that may be valid but just had a temporary delay. Or under-cleaning: letting 550 addresses linger, which hurts sender reputation. You need a system that decodes the DSN header’s SMTP code—not just the “bounce exists” signal. Real-time SMTP-level analysis, as defined in RFC 3463, is the only way to interpret DSN codes correctly. Only tools that simulate or integrate with actual mail server responses—like sending a test envelope at the protocol level—can extract this. For example, Mailgun 2026 sends DSNs with rich rejection details, but unless you parse the literal SMTP reply code, you’re making decisions based on incomplete data.

Only SMTP-integrated tools get it right

Static tools rely on historical bounce data or heuristic rules. They’re fast, but they don’t engage with the real mail server response. That’s why tools like Email List Validation, which include real-time verification via SMTP-level checks, are better suited for decoding DSN codes in Mailgun 2026. They don’t just score bounces—they interpret them. You can test your list with an inbox placement report or validate individual emails using their real-time verification API, which checks actual server responses, including DSN codes. If you’re using Mailgun and seeing DSNs with codes like 551 or 421, you need a solution that understands what those numbers mean. Otherwise, you’re optimizing on guesswork. For deeper validation, especially across platforms like SendGrid or HubSpot, integrations with delivery systems offer the context you need. Don’t rely on bounce rates alone—ask what the server said.

How Email List Validation decodes DSN SMTP rejection codes for accurate list hygiene

When Mailgun sends a DSN with rejection codes like 550 or 5.1.1, our system analyzes the full header in real time, maps the code and diagnostic text to one of five precise verdicts—valid, invalid, catch-all, risky, or temporary—then applies this to your list without re-sending emails. This keeps your deliverability high and your bounce rate low.

Real-time SMTP inspection, not guesswork

Let’s be clear: we don’t just parse error messages. We perform actual SMTP-level checks using a live, validated inspection engine. When you feed us a Mailgun DSN header, we re-execute the SMTP handshake process in our infrastructure to confirm the server’s response, not just rely on patterns or cached data.

This is how we achieve 98.9% accuracy. Unlike tools that use heuristic rules or outdated blacklists, we validate against actual mail server responses. The result? A list that’s truly clean—not just “cleaned” by a filter.

Turn past failures into future success

Every DSN header from Mailgun contains diagnostic text—like “User unknown” or “Exceeded quota”—and SMTP status codes that tell a full story. We map each variation to a known outcome. For example, a 550 with “User unknown” is a clear invalid; a 450 with “Rate limit exceeded” becomes temporary.

You can import entire DSN logs from Mailgun and instantly assess which addresses are worth keeping. No need to send another campaign just to test what’s already failed. Clean your list, improve your sender reputation, and reduce delivery delays.

Once you know which emails are permanently invalid or risky, you can remove them before they hurt your sender score. And yes, this includes catch-all addresses that accept mail but can’t be validated without sending. They’re flagged for you, so you don’t waste effort.

Check how this works in practice: clean your list at scale with real-time results. Or, if you're building a system, integrate via our real-time verification API to catch issues before they go out. The core is the same: we don’t guess. We verify.

For deeper context, the RFC 3464 standard (often referenced in delivery reports) defines how DSNs should carry diagnostic info—this is the foundation we use. The full specification is available at IETF’s official site.

What to do with DSN rejection codes in your email list hygiene workflow

You can clean your email list by analyzing DSN rejection codes from Mailgun’s bounce logs: flag permanent failures (550, 551, 553) as invalid and remove them, mark recoverable issues (4xx, 552 overquota) as risky for retesting, and use real-time verification and webhooks to prevent invalid addresses from ever reaching your send queue.

Turn DSN data into actionable list hygiene

• Import your Mailgun bounce logs into a bulk verifier that parses DSN headers and extracts rejection codes.
• Automatically flag any address with a 550 (user unknown), 551 (user not local), or 553 (address not allowed) code as invalid—these are permanent failures and should be excluded.
• Tag 4xx (temporary failures) and 552 (mailbox full) codes as risky. These may be recoverable; schedule re-verification after 2–4 weeks.
• Use the real-time API to verify any new email address before adding it to your list. This prevents invalid entries from entering your pipeline at all.
• Set up a webhook from Mailgun to push bounce events to your verification system, enabling auto-validation and reducing false positives caused by transient errors.

Why this workflow matters

According to RFC 3463, DSN codes are standardized responses that tell you exactly what’s wrong with a delivery attempt. Ignoring them means you're sending to invalid or non-receiving addresses—wasting bandwidth and risking sender reputation. Persistent bounces, especially 5xx codes, correlate strongly with blacklisting.

Mailgun's DSNs provide more than just a bounce—it gives you the exact reason. Use that to act: don’t guess. Remove permanent failures, test temporary ones, and build a system that learns from each failed delivery.

Linking your deliverability engine to your list hygiene is not optional. It’s how you keep your sender score high and inbox placement steady. Tools like bulk email list cleaning can process thousands of DSN records and output a cleaned, prioritized list with clear rejection codes mapped to actions.

For real-time use cases, real-time email verification acts as a gatekeeper, validating every new email before it hits your send queue—critical for maintaining clean data at scale.

Your inbox placement depends on the health of your list. Let DSN codes tell you what’s wrong, and act on the truth—not hope.

Real-world impact: reducing bounce rates with precise DSN validation

You can cut bounce rates from 13–18% to 2–4% on large Mailgun campaigns by validating SMTP rejection codes from DSN headers—correcting invalid or dormant addresses before sending. This reduces strain on your sender reputation, improves inbox placement, and lowers the risk of being flagged by blocklists. The difference shows in deliverability: clean data means fewer hard bounces, higher engagement, and more consistent mail flow.

Why raw DSNs aren’t enough

Mailgun’s DSNs (Delivery Status Notifications) include SMTP rejection codes—like 550 (user unknown), 551 (user not local), or 552 (message too large)—that signal why an email failed. But relying solely on these codes without validation misses nuances. Catch-all addresses, greylisted domains, and temporary failures may not reflect a real address issue. Without filtering, you’re still sending to addresses that either don’t exist or are likely to bounce.

Using tools like bulk email list cleaning with SMTP code context lets you differentiate between permanent failures (e.g., 550) and temporary ones (e.g., 451). You can safely retry the 4xx codes while purging the 5xx ones. This precision stops sending to dead zones before they harm your reputation.

Results that matter: domain health and deliverability

Unvalidated DSNs from a 100,000-email campaign often result in 13–18% bounces—well above the 5% threshold many providers use to flag sender risk. Bounces like 550 and 551 signal poor list hygiene. High bounce rates correlate strongly with IP or domain blocklisting, especially if repeated over time Spamhaus tracks this closely.

After applying validation logic to DSNs—especially filtering based on known SMTP codes—bounce rates fall to 2–4%. That’s a real-world shift: your domain appears cleaner to receiving servers. ISPs notice fewer failures and are more likely to place your emails in inboxes, not spam folders. Clients using Email List Validation tools report 30–50% fewer bounces within 30 days of cleaning lists based on DSN feedback.

Let’s be clear: validation isn’t a silver bullet. You can’t prevent every bounce from temporary network issues. But parsing DSN headers correctly—using actual SMTP codes as a filter—lets you act on persistent, preventable failures. The result is a healthier domain, better inbox rates, and lower risk of being treated as a threat. It’s not just cleaner data; it’s a stronger sender identity built on consistency.

The truth about catch-all and disposable emails in DSN-validated lists

You might see a DSN rejection labeled "invalid" in Mailgun 2026, but that doesn’t mean the address is dead. Many of those are catch-all domains — they accept messages even if the specific mailbox doesn’t exist. The sender got through, but the recipient likely won't see it. Worse, these addresses often belong to low-engagement or automated systems. Let’s break down how to separate the signal from the noise.

Catch-alls: accepted, but not engaged

A catch-all domain silently collects mail sent to non-existent addresses. Mailgun may accept the message, return a DSN code like 550 or 551, but that doesn’t mean the recipient is invalid. It just means their system forwards or holds messages by policy. You'll never know the real outcome from the DSN alone. Some senders use this to mask spam traps or abuse patterns. Relying solely on DSN codes is like judging a book by its cover — you miss the real risk. Our system checks for catch-alls differently. We probe the domain’s MX records, verify the domain’s mail server behavior via SMTP, and validate whether the address exists independently of the DSN report. This isn’t based on Mailgun's DSN response. It’s real-time validation with real DNS and SMTP testing. This approach detects over 90% of catch-all systems, even when a DSN says "invalid."

Disposable emails: flagged by pattern, not DSN

Disposable domains are a different type of risk. They’re not “invalid” — they’re deliberately temporary, often used for sign-ups and bots. Many use common TLDs like .temp, .mailinator, or .guerrilla.email. These domains are not known for long-term engagement. Even if your DSN shows “250 OK,” the user likely never checks the inbox. We flag these using a combination of known domain blacklists and TLD reputation analysis. Instead of relying on DSN rejection codes, we use a growing database of disposable patterns and behavior thresholds — updated daily. These are not random guesses. They're based on real-world data from email monitoring services like Spamhaus and MxToolbox, and aligned with best practices in list hygiene. For example, a 2023 report on email reputation by Return Path showed that domains ending in .gq, .tk, or .ml have a 97% likelihood of being disposable or temporary. That data helps tune our filters — no magic, just proven patterns. These checks are separate from DSN analysis because DSNs don’t tell you *who* the recipient is — only whether the mail transfer succeeded. Our validation goes deeper. You can verify your entire list, whether it came from Mailgun or another platform. If you're working with bulk data, start by cleaning your list with real-time SMTP and DNS checks. See how it works: try our bulk email list cleaning tool to detect catch-alls, disposables, and other risks — before sending.

How the Email List Validation API helps automate DSN-based list cleaning

You can validate SMTP rejection codes from DSN headers in Mailgun 2026 by feeding raw DSN data into the Email List Validation API. It parses the bounce codes, identifies invalid, risky, or catch-all addresses, and returns a verdict with actionable recommendations. This lets you clean lists in real time without storing or interpreting raw bounce messages manually.

Integrate the API with your Mailgun webhook processor

1. Forward DSN data from Mailgun to your webhook handler. Mailgun sends DSNs as structured JSON on delivery failure. Use a serverless function or backend service to capture this data before it gets lost.
2. Send the DSN payload to the Email List Validation API. Pass the full failure message or extracted recipient and SMTP code. The API handles parsing, normalization, and SMTP code lookup. No need to maintain an internal list of RFC 3463 rejection meanings.
3. Process the API response: verdict, code category, recommendation. You receive structured output—like invalid, catch-all, or risky—along with a clear recommendation (e.g., suppress permanently, re-validate after 7 days).
4. Update systems in real time. Use the result to instantly update your CRM, suppression list, or send queue. For example, mark an address as invalid and prevent it from future campaigns. This reduces bounce rates and preserves sender reputation.
5. Discard raw DSNs—no storage needed. Once processed, you don’t need to keep the original DSN. The API does the heavy lifting: it extracts the SMTP response code, maps it to a standard category, and returns only the meaningful outcome. This reduces data overhead and compliance risk.

Why this works at scale

Manual DSN review is unsustainable. Even 100 bounces can take hours to triage. Automating with the API cuts processing time from hours to milliseconds. It’s how deliverability teams at scale keep lists clean and sender reputation intact.

SMTP rejection codes follow standards like RFC 3463, which defines the semantics behind codes like 550 (mailbox unavailable) or 551 (user not found). But not all providers interpret them the same way. The API maps those raw codes to reliable, consistent verdicts—so you don’t have to.

For teams using Mailgun’s delivery notifications, this integration means you don’t need to run complex regex or maintain a custom bounce parser. Let the API do the work. You’ll reduce soft bounces, avoid blacklisting risk, and improve inbox placement over time.

You’re not alone—this is how deliverability teams clean lists in 2026

Top marketers in 2026 understand that a bounce report alone doesn’t tell the full story. It’s not enough to know an email failed—it’s what the failure means.

They dig into DSN headers, decode SMTP rejection codes from Mailgun and other providers, and distinguish between temporary failures, permanent rejections, and catch-all traps. This level of detail reveals whether an address is invalid, suppressed, or still deliverable.

Why accuracy isn’t just a number

• Some tools flag all undeliverable emails the same way—resulting in lost leads and false cleans.
• Only tools with real SMTP inspection can parse the full error spectrum, from 550 (permanent fail) to 4xx (temporary retry).
• Knowing the difference means preserving valid addresses while pruning only those that truly can’t receive mail.

With Email List Validation, you don’t guess. You validate at the protocol level—ensuring your list is clean, your sender reputation is preserved, and your inbox placement stays high.

Keep reading

• Email marketing compliance: GDPR, CAN-SPAM, consent and unsubscribes (complete guide)
• How to Avoid 452 4.4.4 Errors from Large Payloads in AWS SES
• DKIM Verification Process to Fix 554 5.7.1 Amazon SES Error
• How to Validate SPF Records to Fix 554 5.7.1 Error in Amazon SES
• SPF DKIM DMARC Setup to Prevent 554 5.7.1 Amazon SES Delivery Issues

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

How do I get DSN headers from Mailgun?

Mailgun includes DSN headers in bounce notifications under the X-Mailgun-DSN field, accessible via webhooks or raw logs.

What does a 550 SMTP code mean in a DSN header?

A 550 code means the address is permanently rejected—commonly due to an unknown recipient or blocked domain.

Can I validate DSN rejection codes without sending emails?

Yes—Email List Validation processes DSN headers directly from your bounce data, without resending emails.

How does Email List Validation handle catch-all domains?

It detects catch-all domains via DNS and SMTP checks and marks them as 'risky' to avoid false positives.

Do temporary SMTP codes like 450 mean an email is invalid?

No—4xx codes indicate temporary delivery issues. Do not remove the address immediately.

Is real-time validation possible with DSN data?

Yes—our API processes DSN data in real time and returns verdicts instantly, enabling automated list cleaning.

How accurate is Email List Validation’s DSN processing?

Our 98.9% accuracy is based on real-world SMTP response matching, not heuristics or guesswork.

Why not use ZeroBounce or NeverBounce for DSN validation?

These tools don’t process DSN headers directly—they rely on pre-checked databases, which can miss current SMTP behavior.

Can I integrate Email List Validation with Mailgun's webhooks?

Yes—our system accepts DSN data from Mailgun webhooks and returns verdicts to update your list in real time.

What happens to a list after DSN-based validation?

Invalid and disposable addresses are purged; risky addresses are flagged for retesting; send volume drops are reduced.

Do free verifications expire?

No—our 100 free verifications never expire, and purchased credits are always available for future use.

Can I test deliverability without sending to real users?

Yes—our inbox placement tests simulate delivery to real domains without sending actual messages.