Preserve the reply as evidence

Do not begin with a dashboard category such as “hard bounce.” Open the underlying event and capture the replying host, three-digit SMTP code, enhanced status code when present, text, affected recipient, attempt number, and UTC time. Provider labels are useful conveniences, but their mapping rules differ.

An illustrative response might be:

550 5.1.1 Recipient address rejected: user unknown

The first digit of the SMTP code separates positive, temporary negative, and permanent negative replies. In an enhanced code, the first component similarly indicates success (2), persistent temporary failure (4), or permanent failure (5). The remaining components add subject and detail. Keep the text because not every server uses codes consistently.

Ask who and what failed

Confirm that the reply came from the intended recipient system or an identifiable intermediate service. A permanent recipient-address failure usually calls for suppressing that address after validating the event. A 4.x.x deferral normally calls for bounded retry according to the sender provider’s documented schedule. A policy or authentication response points to sender configuration or reputation, not necessarily to an invalid recipient.

Later delivery-status notifications require extra care. Match the notification to the original envelope identifier and recipient, and reject forged or unrelated messages from your operational workflow. Never forward a full customer message to a public ticket when the response lines are sufficient.

Choose the next investigation

Use a decision record:

  1. Is the failure temporary or permanent according to the actual response?
  2. Is it recipient-specific, domain-wide, or sender-wide?
  3. Did other recipients at the same domain succeed in the same period?
  4. Does the receiver provide a current, official explanation for this response?
  5. Which retry, suppression, or escalation rule applies?

Do not retry permanent failures indefinitely; that creates unwanted traffic. Do not permanently suppress every temporary deferral after one attempt. Where codes and text conflict, retain an unknown/manual-review state instead of forcing certainty.

Verify the outcome

After remediation, send only when you still have authorization and a legitimate reason. Record the new response as a separate event. The issue is resolved when the expected workflow succeeds and monitoring shows no related regression—not merely when the bounce disappears from a filtered dashboard.