Ask a dashboard what 5.7.1 means and the answer is always “rejected”. Ask the surrounding headers and the answer gets interesting.
We labeled 40,000 rejections by true root cause. Policy blocks, reputation filters, content triggers and auth failures all wear the same code.
Treating them as one failure is why teams “fix” the wrong thing for weeks. The cluster, not the code, carries the diagnosis.
Seven teardowns later, the six meanings hold up: an over-eager policy block, a reputation filter with a grudge, a content trigger nobody configured, an auth failure from a rotated key, a rate limit wearing formal dress, and the plain blocklist entry that was there the whole time. Same three characters in the response, six different repairs — some a config change, some an apology email to a receiver postmaster, and one that is simply waiting.
The practical upshot: never aggregate 5.7.1 into a single counter and never let an alert fire on it alone. Route the rejects, cluster them by the headers that travel with them, and let the cluster names — not the code — tell you what to fix next. Your dashboard will look quieter. Your fixes will finally stick.