Start with temporary versus permanent
A 4xx SMTP response normally means the receiver is asking the sender to try again later. A 5xx response normally means the current attempt has been permanently rejected. That distinction determines retry behavior, but it is only the first layer. The enhanced status code and provider text often carry the operational reason.
Locate the command where the receiver rejected the transaction
A failure at RCPT TO tells a different story from a failure after DATA. Recipient validation, local policy and routing often surface before message content is transferred. Authentication, content and reputation decisions can surface after more of the transaction has been evaluated. A transcript gives you this context in a way a copied final sentence does not.
Use provider language as evidence, not decoration
Large mailbox providers attach specific diagnostic text to many rejections. Preserve it. Removing everything except “550” discards the information most likely to separate authentication, reputation, throttling and recipient problems. Mailybox Failure Doctor intentionally accepts the whole NDR or bounce so classification can use those provider-specific clues.
Compare historical evidence with current state
The bounce describes a past delivery attempt. Public DNS describes the domain now. If someone fixed SPF ten minutes after the rejection, a current DNS check can look healthy even though the bounce was valid. A good root-cause workflow records both: what the receiver reported then and what the domain publishes now.
Verify the evidence
Use the live analysis that matches this workflow instead of relying on a generic status check.