How to use SMTP logs for spam-filter diagnosis?

Your campaign finished sending, but the bounce report is full of errors that look like alphabet soup. Something like 550 5.7.1 [BC15] Message rejected due to spam policy or 421 4.7.0 TLS handshake failed. That's your SMTP log talking. Once you know how to read it, it tells you almost everything.

First, understand what SMTP logs actually are. Every time your sending server tries to deliver an email, it has a back-and-forth conversation with the receiving server. That conversation gets logged line by line. The log captures the timestamp, the command sent, and the response received. It's the full transcript of what happened.

Where to find your SMTP logs depends on your setup. If you use an ESP, look in the message activity or delivery log section of your dashboard. Postmark shows per-message delivery details with the full SMTP response. Mailgun has a Logs tab in the dashboard. Twilio SendGrid keeps event data in the Activity Feed and via the Event Webhook. Amazon SES routes logs through CloudWatch. If you're running your own mail server (Postfix, Exim), check /var/log/mail.log or /var/log/maillog.

Reading the response codes. The three-digit code at the start of every server response is the most important number in the log.

• 2xx means accepted. A 250 OK means the receiving server accepted the message. Your job ended there.
• 4xx means a temporary failure. The receiving server is saying "not right now, try again later." A 421 or 450 typically means rate limiting, a greylisting event, or a server that's temporarily busy. Your sending infrastructure should retry these automatically.
• 5xx means a permanent rejection. The receiving server will not accept this message. A 550 or 554 is telling you something is definitively wrong, and retrying won't fix it.

The message after the code is where the real diagnosis lives. Here are some common patterns and what they actually mean:

• 550 5.7.1 [BC15] Message rejected due to spam policy points to a content or reputation policy block at the receiving end. Check your sending IP against blocklists and review your email content for spam triggers.
• 550 5.1.1 The email account that you tried to reach does not exist is a hard bounce on a bad address. Remove it from your list immediately.
• 550 5.7.26 This message fails to pass DMARC checks means your DMARC authentication is failing. Check that your SPF and DKIM records align with your From domain.
• 421 4.7.0 [TSS04] Messages from x.x.x.x temporarily deferred from Yahoo Mail means your IP is rate-limited. This often signals a reputation issue that's not yet a hard block.
• 554 5.7.1 Service unavailable; Client host [x.x.x.x] blocked using Spamhaus tells you your sending IP is on the Spamhaus blocklist. You'll need to request delisting.

Timing tells you which layer blocked you. If the rejection happens during the initial connection (before any message content is transmitted), that's an IP-level block. The receiving server didn't want to talk to your IP at all. If the rejection comes after the DATA command (after your message content was transmitted), that's a content or policy-level filter. The server accepted the connection, looked at the message, and then refused it. That distinction tells you whether to investigate your sending IP reputation or your email content.

The most useful thing you can do is compare logs from successful deliveries against failed ones. Look at what's different. Same content, different recipient domain? That's a domain-specific block. Same recipient domain, but some messages succeed and some fail? Check whether the failures share a sending IP, a particular From address, or a content element.

If you're seeing a pattern of hard bounces across your list, it may be time to clean it. A stale list drives up your bounce rate, which then triggers more aggressive filtering from mailbox providers.

Still if the logs are pointing to an authentication failure and you want to verify your records are set up correctly, you can check your setup with our free Email Header Analyzer. And if you're staring at a 5xx error you can't decode, our SOS hotline is free and we actually pick up.