What’s the difference between “connection timed out” and “refused”?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
You're scanning your bounce logs and you spot two different errors sitting side by side: "connection timed out" and "connection refused." They both mean your email didn't get through, but what's actually happening at the other end is pretty different.
Connection timed out means your sending server reached out and heard nothing back. No answer, no rejection, just silence. The receiving server might be down, overloaded, or a firewall is quietly dropping your packets before they even arrive. It's like knocking on a door and waiting. Nobody answers, but you're not sure if anyone is home.
Connection refused means the server is reachable, but it actively said no. It sent back an RST packet (a TCP-level rejection) telling your server to stop trying on that port. The lights are on, but the door is locked. This usually means the mail port is closed, the service isn't running, or the server has a rule blocking your connection specifically.
In plain terms, timeout is silence and refused is a clear no. Both stop your email from getting delivered, but for different reasons.
Which one is more serious for your reputation? Neither one directly damages your sender reputation the way a spam complaint or a hard bounce does. These are infrastructure-level failures, not judgment calls about your content or your list. That said, a pattern of refused connections from the same domain could mean your sending IP is blocked at that server, which is worth investigating.
Both error types are usually temporary, and your sending infrastructure will retry automatically. If you keep seeing them, check whether the MX records for the recipient domain are healthy, and whether the issue is isolated to one domain or appearing across many. Widespread timeouts might point to a routing or firewall issue on your end. Widespread refusals might mean your IP has ended up on a blocklist at that receiving server.
If you're seeing a lot of these in your logs and can't work out where they're coming from, our SOS hotline is free. Bring your headers and we'll take a look.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
