You open your inbox and find a message from "Mail Delivery Subsystem" with a subject such as "Delivery Status Notification (Failure)". You may not remember sending anything to that address, and the message can look alarming. In most cases it is an ordinary bounce message from a mail system telling you that an email did not arrive. Sometimes, though, it is a sign that someone has used your address to send spam, and now and then it is a scam that copies the look of a bounce. This guide explains what Mail Delivery Subsystem means, why you receive these messages, how to tell a real one from a fake one, what the common error texts mean and what to do next.
What is Mail Delivery Subsystem?
"Mail Delivery Subsystem" is the sender name that Gmail and some other systems put on automatic delivery reports. The address behind it is often [email protected], and other providers use similar names such as "Mail Delivery System", "Postmaster" or "MAILER-DAEMON". It is not a person and it is not a program that reads your mail. It is the part of a mail server that reports what happened to a message.
The technical name for the report is a delivery status notification, or DSN, and the format is defined in an internet standard. A server sends one when it cannot deliver a message, when delivery is delayed for a long time or, if requested, when delivery succeeds. The most common kind by far is the failure notice, also called a bounce. Our guide to SMTP bounce codes and the article on how to read a bounce code go deeper into the codes inside these messages.
Why did I get an email from Mail Delivery Subsystem?
There are five usual reasons. Work through them in this order.
- You sent an email that could not be delivered. This is the most common cause. The address may have a typo, the mailbox may no longer exist, the recipient's mailbox may be full or the receiving server may have refused your message.
- A message you sent was delayed. The notice says the server is still trying and will keep going for a while. No action is needed unless the delay matters.
- An application or device sent mail for you. A website form, a printer, a calendar invite or an automatic forwarding rule may have sent a message from your address without your noticing.
- Someone used your address as the sender of spam. Spammers often fake the From address. When their message fails, the bounce goes to the address they forged, which is yours. This is called backscatter, and you will see bounces for emails you never wrote.
- The message is a scam. Criminals copy the look of a bounce to make you open a link or an attachment.
How to tell a real bounce from a scam
A real bounce has a few reliable features. A fake one usually breaks at least one of them.
- It refers to a message you can identify. A genuine notice includes the recipient's address, the subject line or part of the original message, and the time. If you have no idea what it is about, treat it with suspicion, but do not assume it is a scam, because backscatter looks the same.
- It explains the problem in plain terms. A real notice says something like "address not found" or "the recipient's mailbox is full", often with a code such as 550 5.1.1.
- It does not ask for your password or payment. A bounce never needs your login. If a message from "Mail Delivery Subsystem" asks you to sign in or "verify your account" to release a held email, it is phishing.
- The links go where they say. Hover over a link before you click it, or better, do not click at all. A real bounce rarely needs you to click anything.
- Attachments are unexpected. A genuine notice may attach a copy of your original message, but not an executable file or a zip archive.
- It is in the right place. If it comes from a different domain from your own mail provider, check it carefully. You can open the message headers to see the real sending server. Our article on reading email headers shows how.
If in doubt, go to your own sent folder and see whether you really sent a message at that time, and do not use any link in the suspicious message.
Common failure messages and what they mean
| You see | What it usually means | What to do |
|---|---|---|
| 550 5.1.1 User unknown or address not found | The mailbox does not exist, or the address has a typo | Check the spelling and try another address |
| 552 5.2.2 Mailbox full or over quota | The recipient has no space left | Try later or reach them another way |
| 550 5.7.1 Message blocked or rejected | The receiving server refused it as spam or by policy | See our guide on blocked emails |
| 554 5.7.x Authentication failed | Your message did not pass SPF, DKIM or DMARC checks | Authenticate your sending domain |
| Message too large | The email or its attachment exceeds the recipient's limit | See email size limits |
| Host not found or domain does not exist | The domain after the @ is wrong or has no mail setup | Check the domain spelling |
| Delivery delayed | A temporary failure, with retries still under way | Wait. See queued and deferred email |
Codes that start with 4 are temporary, and codes that start with 5 are permanent. The second and third numbers, such as 5.1.1, give the detail.
What to do when you receive a bounce for an email you sent
- Read the plain-language reason, usually near the top.
- Check the address for typos, a wrong domain, or a missing letter.
- If the address is right, ask the recipient for another one, or contact them by another route.
- If the reason is a blocked message or failed authentication and you send as a business, follow the steps in the guide for blocked messages.
- Resend only after you have fixed the cause. Sending again unchanged will usually produce the same bounce.
What to do when you get bounces for emails you did not send
This is the backscatter case, and it can be worrying, though it is usually not a sign that your account was hacked.
- Check your sent folder for messages you did not write. If you find any, change your password at once and turn on two-step verification, since someone may have access.
- If the sent folder is clean, the spammer probably only forged your address. Your account is likely safe.
- Do not reply or click anything in the bounces.
- If you own the domain, check that you publish SPF, DKIM and a DMARC policy. A DMARC policy tells receivers what to do with mail that claims to be from your domain but fails checks, and it makes forging much less effective. Our guide on authenticating your sending domain explains how. The reports DMARC produces also show who is sending mail in your name.
- Mark the bounces as spam in your mail app if they keep arriving. Waves of backscatter normally die down after a while.
How to stop Mail Delivery Subsystem emails
You cannot switch off delivery reports, since they are how mail systems tell senders about failures, and you would not want to. What you can do is reduce the cause. Keep your address book clean, check addresses before you send, remove bounced addresses from lists and secure your account. If you send to many people, use an address check before the first send. Our email validation tool catches mistyped and non-existent addresses, which are a leading cause of bounces. For a wider look at what makes mail fail, see why emails will not send.
If you run a business that sends email
Bounces are part of life when you send to lists. A few bounces are normal. A high bounce rate harms your reputation with mailbox providers, because it suggests you do not maintain your list. Read each bounce, remove permanent failures from your list quickly, and watch your rate. A sending service records bounces for you, and our email analytics shows them per message. If you use a shared inbox for replies, route bounces away from people, as described in the guide to inbound email processing.
Stop bounces before they happen Check addresses at sign-up and before every campaign, and see every bounce with its reason.
References and further reading
Frequently asked questions
What is Mail Delivery Subsystem?
It is the automatic sender name that Gmail and some other systems use for delivery reports. It tells you that a message could not be delivered, is delayed or was delivered.
Is a Mail Delivery Subsystem email a scam?
Usually not. Most are genuine bounces for emails you sent. A message that asks for your password, a payment or a login is phishing, even if it uses the same name.
Why do I get Mail Delivery Subsystem emails for messages I did not send?
A spammer may have forged your address as the sender, and the bounces come to you. This is called backscatter. Check your sent folder, and secure your account if you find messages you did not write.
How do I stop Mail Delivery Subsystem emails?
You cannot turn off delivery reports, but you can reduce the cause by checking addresses before you send, cleaning lists, securing your account and publishing DMARC for your domain.
What does 550 5.1.1 mean in a bounce?
It means the recipient address does not exist on the receiving server. Check the spelling of the address or ask the person for a working one.