554 5.7.1 [CS03] — Message rejected due to local policy (iCloud)
Retrying will not help. The message will not be delivered.
The reply
554 5.7.1 [CS03] Message rejected due to local policy.Reported on messages carrying an attachment or a link that failed a security check. Of Apple's undocumented labels this is the one most worth answering by changing what the message carries rather than by waiting.
What it means
A permanent policy rejection associated with attachment and link scanning. The trigger is not always the file itself: a link to a host that other people have abused, a document on a file-sharing service, or an archive whose contents cannot be inspected are all enough. As with every label in this family Apple confirms nothing, so treat the association as a good first place to look rather than a diagnosis.
Why it happens
- An executable, script or archive attached — including a .zip whose contents cannot be scanned.
- A link to a file-sharing or cloud-storage host with a poor reputation.
- A URL on a domain or CDN that has been abused by someone else.
- An attachment type that is uncommon for the kind of message being sent.
What to do
- Take the attachment out and link to the file on your own HTTPS domain instead.
- Avoid archives and anything executable. If a document must travel, PDF is the format least likely to be rejected.
- Check where your links point. A shared shortener or a CDN path someone else has abused is enough on its own.
- Scan what you are sending — the rejection is sometimes correct, particularly for mail generated from user-supplied content.
- Send the same message with links and attachments stripped to confirm which of the two is responsible.
Questions
The attachment is a plain PDF. Why reject it?
The attachment may not be the trigger. Links are scanned too, and a URL on a host someone else has abused will do it. Strip the links and resend to find out which half is the problem.