What are IP-level rejections vs content-level rejections?

An IP-level rejection happens at the door. A content-level rejection happens after the receiver has read the letter. Same outcome (your mail did not get delivered), very different diagnosis.

IP-level rejections

This is the receiving server shutting you down during the SMTP conversation, before it has looked at your subject line, your HTML, or your unsubscribe link. The decision is made on who you are, not what you sent.

The receiver checks your sending IP (and sometimes the sending domain) against:

• Public blocklists like Spamhaus SBL/XBL/PBL and Barracuda BRBL
• Their own internal reputation history for that IP
• Authentication results from SPF and DMARC (see RFC 7208 for the SPF spec)
• Rate and volume patterns from that IP in the last few hours

When the verdict is bad, you get a 5xx response on the RCPT TO or DATA command, and the bounce string usually names the reason. Examples you will actually see in logs:

• 550 5.7.1 Service unavailable; Client host [1.2.3.4] blocked using Spamhaus
• 554 5.7.1 https://postmaster.google.com/... [GL01] from Gmail
• 550 5.7.606 Access denied, banned sending IP from Microsoft

These are cheap for the receiver. They never spent CPU scanning your message. That is the whole point of reputation: filter at the cheapest possible layer.

If you want the underlying mechanics of the handshake, see what happens during SMTP connection filtering.

Content-level rejections

Here the receiver accepted your DATA, ran the message through a scoring engine, and then rejected. The engine could be SpamAssassin, Rspamd, a Proofpoint or Mimecast appliance, or Gmail/Microsoft's in-house ML stack. It is looking at:

• Subject and body text patterns (keywords, link density, image-to-text ratio)
• URLs in the body, checked against URI blocklists like Spamhaus DBL and SURBL
• Attachments (macros, executables, mismatched MIME types)
• Header anomalies (forged From, missing Message-ID, weird Received chain)
• DKIM signature validity on the actual content

The bounce wording shifts. You will see things like:

• 550 5.7.1 Message rejected as spam by Content Filtering (Microsoft)
• 552 5.7.0 This message was blocked because its content presents a potential security issue (Gmail, often attachment-driven)
• 554 5.7.1 Message scored too high on spam filter

SpamAssassin-style engines score messages against hundreds of rules and reject above a threshold. That is why two near-identical campaigns can land differently: one tripped a body rule, the other did not.

How to tell which one hit you

Read the full bounce, not just the 5xx code. Both layers throw 5xx, so the number alone is useless. Look for:

1. Where in the SMTP conversation it died. A rejection on RCPT TO or right after MAIL FROM is almost always IP/reputation. A rejection after DATA is almost always content.
2. The text after the code. Words like "blocked", "blacklist", "reputation", "PBL", "SBL", "banned IP" point to IP. Words like "content", "spam score", "attachment", "phishing", "policy" point to content.
3. Whether it is per-recipient or universal. IP rejections usually hit every recipient at that domain. Content rejections can be selective (one recipient's filter is stricter).

For a deeper read on the 5xx vs 4xx distinction, check the related answer in this pillar.

What you do about each

IP-level: stop sending from that IP until you fix it. Check Spamhaus, Barracuda, SORBS, Invaluement. Request delisting only after you have found and fixed the cause (a hijacked account, a bad list, a stuck queue). If it is shared infrastructure, talk to your ESP.

Content-level: keep the IP warm but rewrite. Strip risky attachments, clean up your HTML, run the message through a SpamAssassin scorer, check every URL against URIBL. Look at what changed between the campaign that delivered and the one that did not. Usually it is one thing: a new tracking domain, a new redirect, a phrase the filter learned to hate.

The practical rule: if the bounce names a blocklist or reputation, it is IP. If the bounce names spam score, content, attachment, or policy, it is content. Fix the right layer.