554 5.7.1 [CS01] Message rejected due to local policy
iCloud Mail refused the message on reputation or policy grounds. Apple publishes very little about its filtering, so the bracketed code is the main clue: CS01 is the general content and sender reputation rejection, while HM08 accompanies a DMARC policy rejection and other HM and CS codes cover blocklists and rate limits.
What the server replies
554 5.7.1 [CS01] Message rejected due to local policy. Please visit https://support.apple.com/en-us/HT204137 for additional information.
- Sent by
- Apple iCloud Mail
- Type
- PermanentRetry fails
- About
- Receiver policy
- Enhanced code
- 5.7.1
Who sends it
Apple's inbound servers for icloud.com, me.com and mac.com addresses, after DATA. Apple's filtering is strict about URL reputation and about senders it has not seen before.
Why it happens
- The sending IP or domain has little or no history with iCloud and the message resembles bulk mail.
- A link in the message points to a domain Apple's filters distrust, including some link-tracking domains.
- The sending domain fails DMARC and publishes a reject or quarantine policy (reported as HM08).
- A spike in complaints from iCloud users, who can report spam from the Mail app.
How to fix it
Check authentication first
Make sure SPF, DKIM and DMARC all pass for the sending domain. Apple evaluates them and treats an unauthenticated sender as a stranger.
Test with a minimal message
Send a plain message with no links from the same server to an iCloud address you control. If it arrives, the rejection is about content, usually a link domain.
Use your own domain for links
Point tracking links and images at a subdomain you own instead of a shared platform domain.
Contact Apple postmaster
Apple's postmaster page offers a contact form for senders. Include the full bounce text with the CS or HM code, the IP and the date.
Check it yourself
These free tools show the records and connections behind this code for your own domain or server.
- Email DNS checkerCheck MX, SPF, DKIM, DMARC and reverse DNS for any domain and get the exact records to add or fix.
- DMARC checkerLook up a domain's DMARC record, read every tag in plain words and see what to tighten next.
- Email header analyzerPaste raw headers to see every hop, where the delay was, and whether SPF, DKIM and DMARC passed.
Related codes
- 550 5.7.1 Our system has detected that this message is likely unsolicited mailGmail's spam filter scored the message as spam before it reached a mailbox and rejected it at the SMTP level rather than placing it in the Spam folder.
- 554 5.7.9 Message not accepted for policy reasonsYahoo rejected the message because it failed DMARC and the sending domain's policy says to reject, or because the message failed Yahoo's own authentication requirements for bulk mail.
- 550 5.7.350 Remote server returned message detected as spamMail sent from a Microsoft 365 mailbox was handed to the next server, and that server refused it as spam; Exchange Online passes the verdict back to the sender with this code.
Sources
Fewer bounces to look up.
Faivelo sends from authenticated, warmed infrastructure, turns permanent bounces into one clean event for your application and keeps the address out of future sends.
Free tier included. No card needed.
Other free tools
All tools- Email DNS checkerCheck MX, SPF, DKIM, DMARC and reverse DNS for any domain and get the exact records to add or fix.
- DMARC checkerLook up a domain's DMARC record, read every tag in plain words and see what to tighten next.
- DMARC record generatorBuild a valid DMARC record from a few choices and copy the host and value into your DNS.
- DMARC report analyzerDrop in a DMARC aggregate report and see who is sending as your domain and whether they pass.
- SMTP connection testerConnect to any SMTP server, check TLS and the login step, and see each stage with its timing.
- Email header analyzerPaste raw headers to see every hop, where the delay was, and whether SPF, DKIM and DMARC passed.
- Email address validatorCheck whether an address is well formed, whether its domain accepts mail, and whether it is disposable or a role account.