Comcast / Xfinity — Postmaster: Error Codes, Rate Limits, Unblocking

Comcast's postmaster documentation (formerly postmaster.comcast.net, now served through the Xfinity Service Policy Assurance portal at spa.xfinity.com/help/postmaster) is unusually explicit: it names the blocklists it consults, publishes a SenderScore-indexed rate-limit table, and runs a 24/7 self-service unblock form. Comcast states all policies and thresholds are subject to change.

Provenance note: the SPA portal is a JavaScript app; the code/threshold detail below was captured from the archived postmaster.comcast.net pages (2021–2022 snapshots) that the portal replaced. Treat numeric thresholds as indicative and re-verify current values on the live portal for critical decisions.

Core acceptance requirements ("avoiding blocks")

Rule	Detail
RFC compliance	All email must comply with relevant RFCs
Reverse DNS	Comcast checks rDNS on the sending IP; connections are refused without a valid PTR plus MX or A record
Static IP only	Mail from dynamic/residential IP space is not accepted. An IP is classified dynamic if its rDNS "does not comply with standard static naming conventions"
DNSBLs	Comcast consults external blocklists (historically Spamhaus Zen, Cloudmark CSI, Return Path/SenderScore, Vade/TrendMicro MAPS). A listing on any of them blocks you
List hygiene	High volumes of undeliverables get the IP blocked. Every 550 "Not our customer" must be treated as an unsubscribe by bulk mailers
Abuse management	Enforce AUPs, mitigate compromised accounts. Dictionary/directory-harvest attacks lead quickly to IP blocks
DMARC	Comcast validates inbound DMARC and enforces the sending domain's policy (see DM000001 below); it sends daily aggregate reports from dmarc-support@alerts.comcast.net

Hard limits

Limit	Value
Simultaneous connections per sending IP	25
Emails per SMTP session	1,000
Recipients per message	100
Maximum message size	15 MB
Delisting requests	Max 5 per IP per day, max 20 distinct IPs per day (block-removal form)

Rate limiting (RL codes)

Rate-limited traffic receives a 4xx tempfail — the correct response is to retry later; Comcast's own advice when rate limits bite is to shorten your retry interval. New IPs must warm up: limits increase daily as clean volume history accrues (see IP Warm-Up).

Code	Basis
RL000001	Sender reputation via SenderScore plus authentication of the sending server, regardless of how many domains send from it
RL000002	Sender reputation and volume metrics provided by Cloudmark
RL000003	Historical volume and quality of that volume; independent of domain count; applies to IPv4 and IPv6

SenderScore-indexed hourly throughput (RL000001), as published (two revisions existed; both shown):

SenderScore	Recipients/hour (later table)	Recipients/hour (earlier table)
N/A (no score)	120	300
0–15	1,200	1,200
16–25	3,600	3,600
26–30	6,000	7,200
31–50	12,000	14,400
51–70	24,000	50,400
71–85	42,000	72,000
86–100	60,000	86,400

Subject to successful authentication.

Blocklist error codes (BL series)

The BL code is a bitmask of which external lists the IP is on — each bit position corresponds to one list: (reading BLxxxxxx right to left) Spamhaus Zen, Cloudmark CSI, Return Path/SenderScore blocklist, and Vade Threat List (earlier documented as TrendMicro MAPS). Remediation is always: fix the outbound spam problem, then request removal at the listing service itself (Comcast mirrors the listing; it does not own it).

Code	Listed on
BL000000	Comcast's own filters — sending patterns "characteristic of spam"; use Comcast's removal form
BL000001	Spamhaus Zen
BL000010	Cloudmark Sender Intelligence (CSI)
BL000011	CSI + Spamhaus Zen
BL000100	Return Path Reputation Network Blocklist (SenderScore)
BL000101	Return Path + Spamhaus Zen
BL000110	Return Path + CSI
BL000111	Return Path + CSI + Spamhaus Zen
BL001000	Vade Threat List (VTL)
BL001001	VTL + Spamhaus Zen
BL001010	VTL + CSI
BL001011	VTL + CSI + Spamhaus Zen
BL001100	VTL + Return Path
BL001101	VTL + Return Path + Spamhaus Zen
BL001110	VTL + Return Path + CSI
BL001111	VTL + Return Path + CSI + Spamhaus Zen

Policy error codes (ES, DM)

Code	Meaning	Remediation
ES000001	Sending from a dynamic/residential IP inside Comcast's network; subscribers may only send via smtp.comcast.net	Cannot be lifted. Use Comcast webmail/submission, or contact Commercial Services (support_biz@cable.comcast.com) to run a server
ES000010	Sending from IP space Comcast classifies as dynamic/residential (usually because rDNS doesn't look static)	Fix rDNS to a static naming convention; if the provider can't, escalate to Customer Security Assurance
DM000001	Message rejected because the sending domain publishes DMARC p=reject and the message failed both DKIM and SPF for that domain	Fix authentication/alignment — see DMARC

Generic SMTP errors

Code / text	Meaning
421 Too many sessions opened	Exceeded 25 simultaneous connections per IP
421 Reverse DNS failure : Try again later	rDNS lookup SERVFAILed (auth DNS misconfigured/down); tempfail, retry
421 Try again later	Generic tempfail; retry
452 Too many emails sent on this session	Exceeded 1,000 messages/session
452 Too many recipients for message	Exceeded 100 recipients/message
550 Not our customer	Nonexistent recipient — bulk mailers must treat as unsubscribe
550 …too many invalid recipients	Whole message refused for all recipients; clean the list and resend
550 Invalid sender domain	Sending domain lacks a valid A or MX record
550 Account not available	Recipient account currently unavailable
552 Message size exceeded	Over 15 MB
554 PTR lookup failure	NXDOMAIN on the PTR — no reverse DNS for the connecting IP

Blocklist removal process

1. Identify the code in the bounce; every NDN links to the FAQ explaining the block.
2. External-list codes (BL000001 and up): remediate, then request delisting at the listing operator (Spamhaus, CSI, SenderScore, Vade) — Comcast honors the removal.
3. Comcast-internal blocks (BL000000): submit the Blocked Provider Request Form on the postmaster portal. Mandatory fields: name, email, day/night phone, domain of blocked IP, your role (email admin / executive / subscriber / Comcast subscriber), blocked IP address(es), and an issue description; you can also declare remediation taken (spam filtering implemented, rDNS made static/consistent). Limits: 5 submissions/day, and per third-party documentation up to 20 IPs/day; the form is monitored 24/7 and simple blocks typically clear in well under an hour.
4. Escalation: Customer Security Assurance, 888-565-4329 (referenced on ES/RL/DM code pages when self-service can't resolve).

Feedback loop (FBL)

• Signup: feedback.comcast.net. Both IP-based and DKIM-based registration exist (DKIM-based launched as beta).
• Reports are ARF-formatted, generated by "This is Spam" clicks; full message headers included, but the complainant's address is scrubbed and will never be restored.
• You must be the party responsible for the sending server (on shared servers, the server owner should sign up).
• Historical acceptance criteria: SenderScore ≥ 60 accepted; 30–60 accepted only if on no DNSBLs; < 30 rejected. Denials come with an explanation and remediation steps; reapplying is allowed anytime.
• Comcast reserves the right to suspend feedback to any party at any time.

Comcast's outbound infrastructure (for receivers)

Consumer mail leaves via resqmta-*.sys.comcast.net / resdmta-*.sys.comcast.net hosts (published ranges 96.103.146.x, 96.102.19.x, 96.102.200.x), IPv6 CIDRs 2001:558:fd00::/…, and a bulk-messaging platform (MDP) at 96.114.127.0/27, 68.87.28.32/27 plus two IPv6 /120s. Consult the live portal for the current list.