"450 4.1.8 Sender address rejected: Domain not found" / "553 5.1.8 Domain of sender address does not exist": fix

What it means

The receiving server looked up the domain of your sender address and could not find it in DNS. It refuses mail from a domain that does not seem to exist, because it could never send a reply or a bounce to it. The message usually looks like one of these:

450 4.1.8 <user@yourdomain.com>: Sender address rejected: Domain not found

553 5.1.8 <user@yourdomain.com>... Domain of sender address user@yourdomain.com does not exist

The first one comes from Postfix. The 450 version is temporary, so your server will retry, but it will keep failing until the domain can be found. The 553 version is permanent.

The sender address checked here is the envelope sender, also called Return-Path or MAIL FROM. It is not always the "From" address people see. Apps and servers often set it automatically, for example www-data@server1.local.

Why it happens

• A local or internal name. The envelope sender uses a domain that only exists inside your network, such as .local, .lan, .internal or the bare server name (root@localhost).
• A typo in the sender address, like yourdomian.com.
• The domain has no A and no MX record. Some receivers require at least one of them for the sender domain.
• The domain expired or its DNS hosting was removed.
• A subdomain without records, such as bounce.yourdomain.com used by a tool, that nobody created in DNS.
• DNS problems: your domain's name servers do not answer, or answer badly. In that case the temporary 450 code is common.

How to check

1. Read the bounce. The exact address in brackets is the one checked. Look at its domain carefully.
2. Run a Delivmail test. Send an email from the same app or server to the unique address on the home page (/). The report shows the envelope sender (Return-Path) and the From address, so you can see which domain your app really uses.
3. Scan the domain at /domain-scanner to see its MX records and whether it answers at all.
4. Check the domain registration on /whois to make sure it has not expired.

How to fix it

If the domain is local or wrong

1. Set a real sender address on a domain you own, for example noreply@yourdomain.com.
2. In Postfix, set myorigin and myhostname to real names (for example yourdomain.com and mail.yourdomain.com), or rewrite local addresses with sender_canonical_maps.
3. In PHP or a website, set the envelope sender explicitly (the -f option of mail(), or the "Return-Path" or "Sender" field of your mail library or plugin).
4. In apps and devices, look for a "sender address" or "from address" setting and use a real address.

If the domain is real

1. Make sure it has an MX record (where replies go) and, if possible, an A record.
2. If a tool uses a custom bounce subdomain, create the records it asks for (often a CNAME).
3. Renew the domain if it has expired, and check that its name servers answer.

Using a real domain also lets you set SPF, DKIM and DMARC for it, which you will need anyway for good delivery.

Check that it is fixed

After any DNS change, wait a little for it to spread (usually under an hour). Send a new Delivmail test from the same app: the Return-Path should now show your real domain, and SPF should be checked against it. Then resend the email that bounced, or let your server retry the queued messages.