Yahoo 554 [PH01]: email not accepted for policy reasons

The exact bounce string

The rejection your mail server logs, or the non-delivery report the sender receives, reads:

554 Message not allowed - [PH01] Email not accepted for policy reasons. Please visit https://postmaster.yahooinc.com/error-codes

The leading 554 is a permanent failure. The bracket code is what matters. Yahoo's Sender Hub error-code page at senders.yahooinc.com/smtp-error-codes groups PH-prefixed codes under Content based blocks. Its explanation is that the email was not accepted because something in the content is something Yahoo won't accept for policy reasons. The content it names is viruses, phishing, ransomware, malicious software, and links to any of these.

PH01 is not the DMARC rejection

Several Yahoo bounces end with "not accepted for policy reasons", and they have different causes. The bracketed code is what tells them apart.

• 554 Message not allowed - [PH01]: content-based block. The cause is in the message body, its links or its attachments.
• 554 5.7.9 Message not accepted for policy reasons: DMARC rejection. Yahoo's help article at help.yahoo.com/kb/SLN36434.html ties this string to a sending domain whose DMARC policy is p=reject, often after automatic forwarding.
• 550 5.7.26: unauthenticated mail under the Gmail and Yahoo sender requirements. See 550 5.7.26 unauthenticated email.

If your bounce carries [PH01], start with the content. Changing SPF, DKIM or DMARC records will not clear it.

Rule out authentication first

Yahoo requires every sender to authenticate with SPF or DKIM, and bulk senders to use both plus a DMARC policy of at least p=none that passes (senders.yahooinc.com/best-practices). A broken setup is not what PH01 reports, but confirm it passes before you start on the content. Send a copy of the same message to a mailbox you control and read the Authentication-Results header:

Authentication-Results: ...;
  spf=pass smtp.mailfrom=yourdomain.com;
  dkim=pass header.d=yourdomain.com;
  dmarc=pass header.from=yourdomain.com

Paste the raw headers into the free email header analyzer to get the verdict without reading the line by hand. If DMARC fails, fix that first with DMARC alignment issues. Then come back to the content.

Find what in the message triggered it

Start from the rejected message itself. Your mail server log or the bounce names the recipient and the time; pull the exact message that went out. Your ESP rewrites links at send time, so the rewritten URLs appear only in the sent copy.

1. List every URL in the message. Include tracking redirects, image hosts, and the unsubscribe link. Your ESP's click tracking rewrites links through its own domain, so the domain Yahoo sees is often not the one you typed.
2. Check each domain's reputation. Look every one up in Google's Safe Browsing site status at transparencyreport.google.com/safe-browsing/search. A landing page, a shared link shortener or a compromised third-party site that is flagged there is a likely cause.
3. Check attachments. Executable files, macro-enabled Office documents and password-protected archives are formats that malware uses. If the message carries one, send a version without it and see whether the block clears.
4. Compare with mail that still delivers. If one campaign bounces with PH01 and the rest of your mail reaches Yahoo, the difference between the two messages is the shortlist.

If your account or server sent it

Sometimes the content is not yours. A compromised mailbox or a web form abused as a relay sends phishing under your domain, and Yahoo blocks what it sees. Yahoo's Sender Hub tells senders to check their outbound queues for objectionable content and to secure their servers. Look for:

• Sent-folder or outbound-queue messages that nobody on your team wrote.
• New forwarding rules or app passwords on a mailbox.
• A sudden rise in volume from one account, one IP or one form.

Reset the credentials, remove the rules, and stop the relay before you ask Yahoo for a review. Ask for a review only once the source has stopped sending.

Do not retry, then ask for a review

Yahoo's error-code page says a message that comes back with a 5xx error should not be retried, and list managers should have a policy for removing addresses that generate 5xx bounces. Resending unchanged content gets the same rejection.

Once the cause is removed, open a ticket from the Yahoo Sender Hub contact page at senders.yahooinc.com/contact, under Problems Delivering Mails to AOL or Yahoo mailboxes. Include:

• The full bounce text, with the [PH01] code.
• The sending IP and the From domain.
• The date and time of the rejection.
• What you found and what you changed.

What DMARC reports can and cannot tell you here

DMARC aggregate reports record authentication results per sending source. They do not record content blocks, so a PH01 rejection will not appear in them. They answer the question you ruled out above: whether every source sending as your domain passes SPF and DKIM with alignment. They also show a source you do not recognize sending as your domain, which is what an abused form or a compromised third-party service looks like from the outside. The DMARCTrust DMARC reports view turns the daily XML into a per-source breakdown.

Related fixes

• If Yahoo or Gmail reject mail as unauthenticated, read 550 5.7.26 unauthenticated email.
• If Yahoo defers mail for user complaints, read messages deferred for user complaints.
• If Microsoft 365 recipients bounce the same mail, read 550 5.7.509 sending domain does not pass DMARC verification.
• If mail through your ESP fails DMARC, read ESP mail fails DMARC.
• To read a verdict from raw headers, use the email header analyzer.