Understanding and Troubleshooting 100% Email Rejection Rates (p=reject; pct=100)

This article explains the technical meaning, causes, diagnostics, and remediation steps for scenarios where email delivery statistics report:

p = reject; pct = 100

It is intended for:

• IT Professionals

• System Administrators

• Mail Server Engineers

• Support / NOC Teams

The focus is on SMTP-level message rejection, not soft failures or transport errors.

Overview: What Does “100% Reject” Mean?

In email delivery systems:

• Reject = Receiving SMTP server returned a 5xx permanent failure

• pct = 100 = All delivery attempts were refused

Technical Interpretation

Probability of rejection = 1 (100%)
Acceptance rate = 0%

This means:

✔ Emails reached the recipient server
✔ Recipient server actively refused messages

This is not a connectivity failure.

SMTP Behavior & Architecture

Simplified Mail Flow

Sender MTA → DNS Lookup → Recipient MTA → SMTP Response

Possible SMTP Responses

100% rejection = consistent 5xx responses

Common Scenarios Producing 100% Rejection

1️⃣ Authentication Failures (SPF / DKIM / DMARC)

Symptoms

Bounce examples:

550 SPF check failed
550 DKIM validation failed
550 DMARC policy reject

Root Causes

• Missing SPF record

• Incorrect SPF syntax

• DKIM not signing

• DMARC policy enforcement

Diagnostics

Check DNS:

nslookup -type=txt yourdomain.com

Online SPF test equivalent:

dig txt yourdomain.com

Correct SPF Example

v=spf1 include:_spf.google.com ~all

Correct DMARC Example

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

2️⃣ IP / Domain Reputation Issues

Symptoms

550 Message rejected due to reputation
554 Blocked using Spamhaus
550 Access denied

Root Causes

• Blacklisted sending IP

• Poor sender reputation

• High spam complaint rate

Diagnostics

Check RBL listings:

nslookup your.ip.address.zen.spamhaus.org

If response returns an IP → Listed.

3️⃣ Reverse DNS / PTR Issues

Many servers require valid PTR.

Symptoms

550 Reverse DNS required
550 HELO/EHLO rejected

Diagnostics

nslookup your.ip.address

Expected:

Name = mail.yourdomain.com

Mismatch → Likely rejection.

4️⃣ HELO / EHLO Misconfiguration

SMTP identity mismatch triggers rejection.

Symptoms

550 Invalid HELO hostname

Correct Configuration Example (Postfix)

postconf myhostname

Ensure:

myhostname = mail.yourdomain.com

5️⃣ Content-Based Policy Rejection

Triggered by:

• Spam-like wording

• Broken HTML

• Suspicious attachments

Symptoms

550 Message content rejected

Step-by-Step Troubleshooting Workflow

✅ Step 1: Inspect Bounce / SMTP Logs

Postfix Example

tail -f /var/log/mail.log

Look for:

status=bounced
reject=...
dsn=5.x.x

✅ Step 2: Validate DNS Authentication

Check:

✔ SPF
✔ DKIM
✔ DMARC

Tools:

dig txt yourdomain.com
dig txt default._domainkey.yourdomain.com
dig txt _dmarc.yourdomain.com

✅ Step 3: Verify Reverse DNS

nslookup your.ip.address

✅ Step 4: Check Blacklists

Use RBL queries or reputation services.

✅ Step 5: Test SMTP Conversation

telnet recipientserver.com 25

Example:

EHLO mail.yourdomain.com
MAIL FROM:<test@yourdomain.com>
RCPT TO:<user@recipient.com>

Observe rejection reason.

Common Errors & Fixes

Security Considerations

100% rejection may indicate:

✔ Compromised server
✔ Spam outbreak
✔ Reputation collapse

Always verify:

• Outbound mail queue spikes

• Unauthorized relay

• Malware activity

Example check (Postfix):

mailq

Risks of Ignoring Rejection Issues

✔ Business email disruption
✔ Reputation damage
✔ Domain/IP blocking escalation

Best Practices & Recommendations

Authentication Hardening

✔ Always configure:

• SPF

• DKIM

• DMARC

Reputation Protection

✔ Gradual IP warm-up
✔ Avoid spam-like content
✔ Monitor bounce rates

Infrastructure Hygiene

✔ Valid PTR / Reverse DNS
✔ Matching HELO identity
✔ TLS configuration

Monitoring

Track:

• Reject rates

• Bounce categories

• Reputation metrics

Conclusion

p=reject; pct=100 is a policy / trust failure, not a transport failure.

It indicates:

✔ Messages reach recipient servers
✔ But fail validation / reputation / policy checks

Systematic diagnostics — logs, DNS, PTR, reputation — will isolate the root cause quickly.