SMTP 521 and 556 Reply Codes
Extracted elements (15)
Reply code 521 was introduced to distinguish hosts that never accept mail from the broader use of 554, which covers rejection of mail from particular sources, destinations, or addresses. A dedicated code allows clients to distinguish permanent, host-wide non-acceptance from policy-based rejection.
Reply code 556 was created specifically for relay scenarios where a receiving SMTP system can determine from an out-of-band source (such as the DNS null MX record defined in RFC 7505) that a target domain accepts no mail, without needing to attempt a connection to that target host.
When a dummy SMTP server is run to conserve resources, closing the connection immediately after returning 521 (rather than continuing to respond to further commands with 521) is preferable, since resource conservation is the stated purpose.
Without codes like 521, a host that does not run SMTP causes connection attempts to time out, forcing clients to queue messages and retry for extended periods, wasting resources and delaying error notification to originators. A dummy SMTP server returning a fatal error is the preferred alternative.
This document updates RFC 5321 by adding 521 ('Host does not accept mail') to the CONNECTION ESTABLISHMENT command-reply sequences (preceding 554) and 556 ('Domain does not accept mail') to the RCPT command-reply sequences.
This specification formalizes reply code 521 and supersedes the Experimental RFC 1846, ending the experiment proposed in that document. Implementations previously relying on RFC 1846 behavior should treat 521 as now standardized under RFC 7504.
After a 521 reply is returned instead of the usual 220, the SMTP session proceeds normally. If the client sends additional commands other than QUIT, the server MAY continue sending 521 reply codes or simply close the connection.
Reply code 521 MAY be used in other situations where the intent is to indicate that the host never accepts mail, beyond dedicated dummy SMTP servers.
Reply code 521 SHOULD be used for dummy SMTP servers whose sole purpose is to notify connecting systems that the host never accepts mail.
Reply code 521 SHOULD NOT be used for situations in which the server rejects mail from particular hosts, addresses, or destinations; reply code 554 is more appropriate for those conditions.
When an SMTP server returns a 556 reply code in response to a RCPT command, the SMTP client is expected to handle the response like any other permanent negative completion reply to that command, consistent with the SMTP specification.
Reply code 521 indicates that the SMTP server host does not accept mail under any circumstances. It is used at connection-opening time in place of the usual 220 greeting, with an accompanying message such as 'Server does not accept mail'.
Reply code 556 indicates that an intermediate SMTP system (typically a relay) has determined, without attempting a connection, that a forward-pointing address resolves to a host that does not accept mail. It is returned in response to commands such as RCPT that contain forward-pointing addresses.
This document updates the 'Enumerated Status Codes' subregistry of the SMTP Enhanced Status Codes Registry: reply code 521 is added to enhanced code X.3.2, and reply code 556 is added to enhanced code X.1.10 (with the note that additional enhanced codes may be needed if new uses for 556 arise).
Running a minimal dummy SMTP server that emits only fixed strings in response to connections provides significantly fewer attack surfaces than a full SMTP implementation. Use of the specific 521/556 codes provides more information to clients than a generic 5yz response but has no other security impact.