SMTP error 5.7.0 Other or undefined security status

What SMTP error 5.7.0 means

This is the catch-all of the security and policy family. Something in the security layer refused the transaction and the server either could not classify it or deliberately would not say. It carries the widest spread of reply codes of anything in this group, from 220 on a greeting through 530 and 535 during authentication to 550 on an outright refusal, so the three-digit number and the free text beside it hold all the useful information. Treat 5.7.0 as an instruction to go and read the raw log, not as a diagnosis in itself.

Security or policy status
Sent by Any server or gateway in the path that declined to be specific
Occasional

What SMTP error 5.7.0 Other or undefined security status actually means

A receiving system has decided that a security or policy condition applies and has chosen the general code rather than a specific one. Sometimes that is laziness in an implementation that never mapped its verdicts onto detail codes. Just as often it is deliberate: a filtering gateway will not explain to an unauthenticated stranger exactly which rule stopped them, because that is free tuning advice for a spammer. The class digit changes the meaning entirely here, more so than for most codes. Seen as 2.7.0 it is an annotation on a message that was accepted, typically alongside a successful authentication exchange. Seen as 4.7.0 the sending server keeps retrying and nothing bounces yet. Seen as 5.7.0 the decision is final.

Something related to security caused the message to be returned, and the problem cannot be well expressed with any of the other provided detail codes. This status code may also be used when the condition cannot be further described because of security policies in force.
— RFC 3463

How 5.7.0 appears in a bounce

A server reporting this condition sends it alongside a three-digit reply code, and a bounce prints the two together. The registry lists these pairings for this status: 500 5.7.0, 501 5.7.0, 503 5.7.0, 504 5.7.0, 530 5.7.0, 535 5.7.0, 550 5.7.0. Which one you get depends on the point in the conversation at which the server refused. The registry also lists 220 and 235 and 450 and 454 for this condition, but those belong with 2.7.0 rather than with this code, because a reply code and the status beside it always agree on whether the failure is temporary or permanent.

The leading 5 is the server's verdict rather than part of the code's identity: it marks this as a permanent failure, which means the sending server has given up and returned the message. The same condition reported as 2.7.0 or 4.7.0 is the other verdict on the identical problem, so a log showing that form has not produced a bounce yet.

What causes SMTP error 5.7.0 on a business phone system

A filtering gateway being deliberately terseMimecast, Proofpoint and Barracuda all reject with wording chosen to give away as little as possible. The enhanced code stays generic on purpose whilst the free text carries a vendor reference you can quote to their support or look up in their console.
An anti-spam verdict with no dedicated codeReputation and content decisions have no neat entry in the registry, so vendors fall back to the general security code. If the rejection mentions a score, a policy name or a rule identifier, that string is what to search for rather than the number.
A transport or DLP rule of your ownExchange Online transport rules that reject with an explanation, and data loss prevention policies blocking mail containing card or bank details, both surface this way. It is worth checking your own rules before raising anything with a supplier, because they are the fastest thing to rule in or out.
A client trying to send before authenticatingA 530 with wording about authentication required is a device that has skipped the AUTH command entirely, usually because a credential field was left blank in its configuration and it fell back to anonymous submission.
A TLS negotiation reported without detailWhere a session cannot agree a cipher or protocol version, some implementations report the failure through the general security code rather than through anything more precise. Correlate against whether the same host works from a different network.

How to fix SMTP error 5.7.0

Capture the whole line, not the codeThe enhanced code alone is close to useless here. You want the three-digit reply, everything after it, and the hostname of the system that said it. In a Microsoft 365 non-delivery report this appears under the remote server response.
Search on the wording rather than the numberGateway vendors publish their rejection strings and what they mean. A distinctive phrase from the text will find the vendor article far faster than 5.7.0 ever will.
Note the class digit before you plan anythingA 4.7.0 buys you time, because the sending server will keep trying for the length of its retry window. A 5.7.0 has already generated a bounce and the message will not arrive without being resent.
Check your own policy layer firstReview transport rules, DLP policies and connector restrictions in the Exchange admin centre, or the routing and compliance rules in Google Workspace. Look particularly at anything added recently, since a rule written for one scenario often catches a second nobody considered.
Pull the verdict from the gateway consoleIf mail is being rejected on the way in to you, the filtering platform holds the sender IP, the authentication results and the reason. That record is far more specific than anything the sender will ever see in their bounce.

Fixing the underlying problem

This page explains the code. These guides walk through the fix in detail.

Questions about SMTP error 5.7.0

Why will the server not tell us what the actual problem is?

Because telling you would also tell everybody else. Filtering platforms treat detailed rejection reasons as information that helps bulk senders tune their way past the filter, so they answer generically by design. The detail exists, it is just held in the receiving organisation's console rather than sent back to you.

We have seen 2.7.0 in a log — is that a failure?

No. The leading 2 means success, and this code can legitimately appear on an accepted transaction as a note about the security state of the session. It commonly turns up next to a successful authentication rather than next to anything that went wrong.

Which log gives us more than the bounce does?

For Microsoft 365, message trace in the Exchange admin centre will show whether the message left your tenant and which connector it used. For inbound rejections it is the filtering gateway that holds the verdict. If both ends are yours, protocol logging on the send connector gives you the full session transcript.

Related SMTP status codes

Source. SMTP error 5.7.0 Other or undefined security status is defined in RFC 3463 and registered in the IANA SMTP Enhanced Status Codes registry. The causes and fixes above are drawn from our own experience supporting UK business email systems.

All Email delivery & SMTP codes