The short answer

SMTP 541 is not a standard RFC 5321 reply code. It is emitted by anti-spam gateways and filtering appliances to reject a message for policy or reputation reasons, and is often confused with enhanced status 5.4.1, which most commonly means a recipient-rejected or access-denied problem, not a spam block. The fix: authenticate your mail with SPF, DKIM, and DMARC, check your sending IP and domain against blocklists, and stop content that trips spam filters.

Quick fix

Content or reputation triggered a block — improve sender reputation and ask the recipient to whitelist you.

5 - Permanent. The server will not try again. Fix the cause before you resend.

What it means

There is no 541 reply code in RFC 5321. The standard codes in section 4.2.3 include 550 through 555, with 521 and 556 added later by RFC 7504, but 541 is nowhere in the spec. So a "541" is almost always one of two things: a vendor or appliance rejection, where an anti-spam gateway in front of the recipient mail server refuses a message for policy or low reputation with a banner like "541 5.7.1: Message rejected as spam by Content Filtering" or "541 Denied by policy"; or a misread of enhanced status 5.4.1, which written without dots looks like "541" but is unrelated and usually points at a recipient or access problem. The number alone is ambiguous, so read the full bounce text.

Common causes

• Policy or content rejection
  A filter classified your message as spam or a policy violation. The matching enhanced code is 5.7.1, "delivery not authorized, message refused" (RFC 3463, the X.7 security or policy class). Triggers include spam-like content, poor brand or reply-to reputation, or recipient rules that block unauthenticated or cold mail.

• Sending IP or domain reputation or blocklisting
  Gateways score the connecting IP and sending domain. Spam complaints, a shared IP gone bad, or a Spamhaus-style listing cause a reputation-based refusal.

• Missing or failing authentication
  Mail with no valid SPF (RFC 7208), no DKIM (RFC 6376), or failing DMARC (RFC 7489) alignment is increasingly rejected outright by strict receivers.

• A literal 5.4.1 misread as 541
  By the RFC, X.4.1 is a network and routing status framed as transient (strictly 4.4.1), but in practice the most common emitter of 550 5.4.1 is Microsoft Exchange or Microsoft 365, where it means "recipient address rejected: access denied", a recipient or access problem, not a network outage.

How to fix it

1. Read the entire bounce string, not just the number
   Note whether it says 5.7.1 (policy or spam), names a filter vendor such as Barracuda or Proofpoint, includes a blocklist URL, or is literally 5.4.1 (recipient or access). This determines everything below.

2. Verify sender authentication
   Publish and validate SPF, DKIM, and DMARC for your sending domain. Check MX and SPF with Google Check MX, and verify DMARC alignment with a tool such as dmarcian DMARC Inspector or MXToolbox. This is the highest-leverage fix for modern policy rejections.

3. Check your IP and domain reputation
   Look up your sending IP against major blocklists such as Spamhaus. If listed, follow that list delisting process and fix the source of spam before re-applying.

4. Audit the message content
   Remove spam-trigger patterns: deceptive subject lines, link shorteners, mismatched display names, image-only bodies, and a high image-to-text ratio. Send real, personalized mail rather than bulk cold mail to unvalidated addresses.

5. If a specific gateway is named, contact that receiver or vendor
   Reputation problems spanning an appliance vendor often need an allow-listing or reputation review directly, such as Barracuda removal request process. Ask the recipient admin to allow-list your domain if you have a legitimate relationship.

6. If the code is truly 5.4.1, stop treating it as spam
   Confirm the recipient address exists and is accepted on the receiving side. On Microsoft 365 this is usually a missing or unsynced recipient or Directory-Based Edge Blocking, not an outage. Only with evidence of a connectivity problem should you check that the recipient MX records resolve and retry.

Paired code

A real bounce often shows both a 3-digit code and an enhanced code together. This one commonly pairs with:
X.7.1Delivery not authorized

Common questions

• Is 541 a real SMTP error code?
  No. RFC 5321 does not define a 541 reply code; the standard permanent-failure codes are 550 through 555 plus 556. "541" is a vendor rejection from commercial anti-spam gateways and appliances, or a misreading of enhanced status 5.4.1.

• Is SMTP 541 the same as 5.4.1?
  No. A true 541 banner is a vendor spam or policy rejection, usually paired with 5.7.1. A literal 5.4.1 is a different, RFC-defined status, most often seen as Microsoft 550 5.4.1 meaning "access denied" for a recipient that does not exist or is blocked.

• How do I stop getting SMTP 541 rejections?
  Authenticate with SPF, DKIM, and DMARC, clear any blocklist listing on your sending IP or domain, and remove spam-trigger content. If a named gateway is blocking you, request a reputation review or allow-listing.

Related codes

• 554Transaction failed.
• 550Mailbox unavailable / address rejected.
• 553Mailbox name not allowed / invalid address.
• 540Not a real code — usually 5.4.0, or a provider literal rejection.
• 551User not local; relay denied.

All SMTP error codes

Ready when you are