How do you identify which layer blocked you (ESP, ISP, filter, recipient)?

Your email bounced. Now what? The bounce message is telling you exactly where things went wrong, but you have to know how to read it. There are four layers that can block a message, and each one leaves a different fingerprint in the error text.

Here's how to figure out which layer stopped you.

Step 1: Find the actual bounce message

Log into your ESP and pull the bounce details for the failed send. Every platform surfaces this differently, but you're looking for the raw SMTP error text, not a summary like "undelivered". You need the actual rejection string. That's where the clues live.

Step 2: Match the error to a layer

Here's how the four layers tend to announce themselves:

• Your ESP blocked it. The message never left your sending platform. Look for errors like "account suspended", "sending domain not verified", or "daily sending limit exceeded". These come before any outside server is even contacted.
• A gateway or content filter blocked it. The message left your ESP but hit a security filter sitting in front of the recipient's mail server. Error text referencing Spamhaus, Barracuda, Proofpoint, or Mimecast tells you a third-party filter made the call. You'll often see a 550 or 554 code with a filter or blocklist name embedded in the text.
• The recipient's ISP or mailbox provider blocked it. You'll see the provider name in the rejecting server's hostname or the error message itself. References to Gmail policies, Microsoft 365 rules, or Yahoo Mail bulk thresholds mean the final mailbox provider made the decision. Common patterns include "550 5.7.1 Your message was rejected due to policy violations" or "421 Too many connections" for temporary throttling.
• The recipient's own server or admin blocked it. Smaller companies and enterprise accounts often run their own mail infrastructure with custom allow/block rules. Error text like "550 blocked by administrator" or "user unknown" with no mention of a known provider or filter usually points here.

Step 3: Separate hard bounces from soft bounces

A 5xx code (500-599) is a hard rejection. The receiving server made a definitive decision and won't accept the message. A 4xx code (400-499) is a temporary deferral, meaning the server is asking you to try again later. Throttling and rate-limiting from ISPs almost always show up as 4xx. Actual blocks are almost always 5xx. The difference matters because SMTP logs will show repeated 4xx attempts before a final 5xx if the delivery was deferred then eventually rejected.

Step 4: Check whether the block is domain-level or IP-level

If the error references your sending IP address, the reputation problem lives at the IP. If it references your domain name, it's a domain-level block. These need different fixes. An IP block might mean you're on a shared IP that got listed, while a domain block often points to authentication failures or spam complaint history tied to your sending domain.

Still not sure which layer you're looking at? Paste your full bounce message into our free Email Header Analyzer and it'll flag the key signals for you. Or if things are breaking urgently, hit our SOS hotline and we'll read it with you.