554 5.7.1 [CS01] — Message rejected due to local policy (iCloud)
Retrying will not help. The message will not be delivered.
The reply
554 5.7.1 [CS01] Message rejected due to local policy.iCloud looked at the message and refused it. CS01 is the label on the filter that fired, not a statement about what was wrong with the mail, and Apple will not tell you which rule it was. In practice the strongest predictor is how much history the sending domain has: new domains draw this code on mail that every other receiver accepts.
What it means
A 554 arrives after the message body has been transmitted, so the whole message was read before it was refused. The enhanced code 5.7.1 is the policy class — "I could have delivered this and chose not to" — which is a different thing from a bad address or a broken record. Apple's own postmaster team describes these rejections as specific to particular senders and campaigns rather than to an IP, so a CS01 on one domain says nothing about the next domain on the same server.
Why it happens
- The sending domain is new and has almost no delivery history. This is the common case and the one that resolves on its own.
- The domain or IP has a reputation problem at Apple specifically — its filters are independent of Spamhaus and of every public blocklist.
- Recipients have marked earlier mail from this sender as junk. Apple offers no feedback loop, so this is invisible until it shows up as a rejection.
- Something in the message resembles a pattern Apple filters: a bare link-shortener, a redirect through a domain unrelated to the sender, or a body that is one image.
- The mail is being sent to addresses that never asked for it, including addresses collected rather than confirmed.
What to do
- Check the sending domain's age and volume first. If it is days old, that is almost certainly the answer, and the fix is ordinary traffic to receivers that do accept it.
- Stop retrying. A 554 is permanent, every repeat is another rejection recorded against a domain that has no history to spend, and hand-retrying a signup flow is the fastest way to make this worse.
- Confirm SPF, DKIM and DMARC all pass and align on the From: domain. They will not lift a policy block on their own, but failing them guarantees one.
- Send the same message to a mailbox at another provider. If it arrives cleanly at Gmail and Outlook, the content is not your problem and you can stop rewriting it.
- Publish forward-confirmed reverse DNS for every sending IP and keep the From: address stable — Apple names both as requirements.
- If it persists on a domain with real history, write to icloudadmin@apple.com with your company name, domain, sending IPs, the exact reply including its Txn ID, and when it started.
Questions
Does CS01 mean my content was flagged?
It is widely claimed to, and we cannot reproduce it. We have byte-identical messages that drew CS01 from one sending address and HM08 from another sixty minutes later — same body, same subject, same signature. Whatever separates the two labels, the message is not it.
What is the Txn ID for?
It identifies that one SMTP transaction in Apple's logs. It is the single most useful thing to quote if you write to their postmaster team, and it is worth recording every time rather than reconstructing later.
Will asking Apple to unblock me work?
There is no allow list to be added to — Apple says so directly. Their postmaster team will look at a specific transaction and tell you whether they see something actionable, which is worth doing once you have ruled out the ordinary causes, and not before.
How long until a new domain gets through?
There is no published figure and Apple will not give one. What we observe is that domains with a few hundred delivered messages behind them reach iCloud normally, including to Hide My Email relay addresses, while domains in their first days do not.