iCloud "554 5.7.1 [CS01] Message rejected due to local policy" and "[HM08]": how to fix it

What it means

Apple's iCloud Mail (addresses ending in @icloud.com, @me.com and @mac.com) refused your message. The bounce usually looks like this:

554 5.7.1 [CS01] Message rejected due to local policy. Please visit https://...

554 5.7.1 [HM08] Message rejected due to local policy. Please visit https://...

"Local policy" means Apple's own filtering rules decided to refuse the email. Apple publishes very little about each code, so the exact rule is not shown. In practice, both CS01 and HM08 are linked to how trustworthy your email and its sender look: authentication, sending IP reputation and content.

Why it happens

• Authentication problems. No SPF, no DKIM signature, or a DMARC failure for the From domain. Apple increasingly expects SPF and DKIM on all mail, and DMARC for senders who send in volume.
• Poor IP reputation. Your IP is on a blocklist, is new with no history, or is shared with senders who sent spam.
• Missing or generic reverse DNS. The IP has no PTR record (the name attached to the IP), or a generic one that looks like a home connection.
• Content that looks like spam or phishing, links to flagged domains, or URL shorteners.
• Complaints from iCloud users who marked your messages as junk.
• Volume: a sudden burst of emails to iCloud addresses.

How to check

1. Run a Delivmail test. On the home page (/), copy your unique test address and send it the same email from the same server or tool. The report shows SPF, DKIM, DMARC, the reverse DNS of the sending IP, blacklists, link domains and a SpamAssassin score.
2. Scan your domain. Use /domain-scanner to check that your SPF and DMARC records exist and are valid.
3. Check the IP and your domain on /blacklists.
4. Read Apple's postmaster information. Apple has a "postmaster information for iCloud Mail" page in its support site. It lists its requirements and how to contact the iCloud Mail team. Search for it by that name, as the address of the page changes from time to time.

How to fix it

1. Authenticate your mail.
   • One SPF record that lists every server and service sending for your domain.
   • DKIM signing with your own domain (not only the provider's domain).
   • A DMARC record, at least v=DMARC1; p=none; rua=mailto:..., so you can see who sends as your domain.
2. Fix reverse DNS. If you run your own server, ask your hosting company to set a PTR record such as mail.yourdomain.com, and make sure that name points back to the same IP.
3. Get off blocklists if your IP or domain is listed, after fixing what caused the listing.
4. Clean up your content. Use your own domain in links, avoid shorteners, keep a good balance of text and images, and include a working unsubscribe link for marketing mail.
5. Respect your recipients. Send only to people who asked for your emails and remove addresses that bounce.
6. Contact Apple if everything is clean and the rejection continues. Use the contact given on Apple's postmaster page, include the full bounce message, your sending IP and the date and time.

On a shared email provider

If you send through a hosting company or a sending service, its IP may be the problem. Forward the bounce to their support and ask whether other customers see iCloud rejections.

Check that it is fixed

Send a new Delivmail test: SPF, DKIM and DMARC should pass, the reverse DNS should be valid, and blacklists should be clean. Wait for DNS changes to spread (usually under an hour). Then send the email again to the iCloud address that bounced. If reputation was the cause, it can take a few days of clean sending before iCloud accepts all your messages again.