SMTP error 551
User not local; relay denied.
Updated Jul 1, 2026
SMTP 551 is a permanent 5yz reply defined in RFC 5321 as "user not local; please try <forward-path>": the receiving server will not accept mail for that recipient and, where possible, names the server you should send to instead. Fix it by correcting the recipient address or your MX and routing so mail reaches the host that hosts the mailbox. If you see "551 relay denied", authenticate with SMTP AUTH.
Send through a server you are authorized to relay on — authenticate to your own provider.
What it means
551 is a permanent negative reply defined in RFC 5321 section 4.2.3 with the canonical text "551 User not local; please try <forward-path>". The receiving server is saying the mailbox you addressed is not handled here and, if it can, names the server to deliver to instead. Because it is a 5yz code it is permanent, so retrying the same address against the same server fails again. In practice you will also see vendor variations like "551 User not local or invalid address, relay denied" or "551 5.7.1 ...", where providers use 551 to signal an unauthorized relay attempt rather than a true wrong-server redirect.
Common causes
The host you connected to does not handle that recipient and refuses to relay or store for it. In the strict RFC reading, the forward-path after the message names the correct host or address to try.
RFC 5321 says a server declining to relay for policy reasons should return 550, but some servers (MailEnable, Plesk, older MTAs) emit 551 for the same situation. Treat a 551 mentioning "relay" as an authorization or routing problem on the sending side.
DNS MX records that point to a server which is not local for the recipient send mail to the wrong host.
A full mailbox or a momentarily unavailable server produces a transient 4yz reply such as 452 4.2.2, not 551, so do not troubleshoot 551 as a soft bounce.
How to fix it
- Check the recipient address and its MX records
Confirm the address is correct and that the domain MX records point to the host that hosts the mailbox. Verify with "dig MX recipientdomain.com" or "nslookup -type=mx recipientdomain.com".
- Send to the host named in the forward-path
If the 551 reply includes a forward-path, deliver to that server or address. Per RFC 5321, the client should redirect according to the information provided or return the failure to the sender.
- Authenticate if you are relaying
For "551 ... relay denied", log in with SMTP AUTH on the submission port, 587 with STARTTLS or 465 with implicit TLS (both valid per RFC 8314). Less Secure Apps is fully retired: personal Gmail lost it on May 30, 2022, and the Google Workspace admin-console setting was removed on September 30, 2024, with OAuth enforcement completed by mid-2025. Use an App Password with 2-Step Verification or OAuth2.
- Fix server routing if you operate the receiving MTA
If your own server returns 551 for addresses it should accept, configure it as authoritative for that domain (local delivery or accepted domain) or add the correct relay or transport route so it stops treating local recipients as non-local.
Paired code
A real bounce often shows both a 3-digit code and an enhanced code together. This one commonly pairs with:
Common questions
Is SMTP error 551 a hard bounce or a soft bounce?
A hard (permanent) bounce. 551 is in the 5yz permanent-failure class of RFC 5321, so the same address to the same server fails again. A full mailbox or a temporarily unavailable server returns a transient 4yz code such as 452 4.2.2, not 551.
What is the difference between SMTP 551 and 550?
550 generally means the mailbox is unavailable or the message was rejected by policy. 551 means the mailbox is not handled by this server, which points you at either a routing or MX correction or, in the vendor "relay denied" variant, at authenticating.
Why do I get "551 relay denied" when sending mail?
You are sending through a provider SMTP server to an outside domain without authenticating. Log in with SMTP AUTH on port 587 or 465 using an App Password or OAuth2, since the server will not relay for an unauthenticated client.