Preserve the full SMTP response before changing configuration. A three-digit code such as 550 describes a response class, not one universal root cause.
Invalid credentials for relay
Check which relay authentication method is configured and which identity the sender actually presents. Compare that evidence with the relevant Google Workspace relay rule. Avoid repeatedly rotating credentials before confirming that credentials are the mechanism in use.
Mail relay denied
Verify the sending IP, allowed domains, envelope sender and relay route. An expected IP in a configuration list is not proof that Google observed that IP for this transaction.
Limit-related responses
Google documents limits across several dimensions, including users, recipients, organizations and transactions. Do not reduce this to one universal daily number. Keep the exact text, time range and affected scope.
Validate after a change
Run one controlled test. Record the new SMTP response and Message-ID, then confirm the corresponding Workspace event. A disappearing application error without an observed event is not a complete validation.
Safe conclusion format
Prefer:
Google returned this response for this observed identity and IP. The next check is this relay rule.
Avoid:
All 550 errors are caused by the same authentication setting.
What this evidence can and cannot prove
The complete SMTP response proves what the relay returned for this transaction—not why every future send will fail, and not whether the message was stored or delivered. Application logs that stop at “connection OK” are weaker than the full code and text from the SMTP dialogue.
If the message never appears in Google
Some failures occur before a searchable delivery event exists. If the application never received 250 OK for the data phase, Email Log Search may stay empty even though operators saw a generic application error. Collect independent SMTP evidence before assuming Google accepted the message.
How this differs from a point tool or a DMARC report
SMTP testers and header parsers do not apply your Workspace relay rules or show admin-side relay configuration. DMARC reports do not explain 550 relay denied for an internal application send. Use native relay documentation (sources G02, G09) for rule semantics; use comparatives for tool boundaries: Google native evidence vs DMARC aggregate platforms.
Sources
This guide is based on Google’s SMTP relay error catalog, Gmail SMTP error documentation, relay spam policy and current relay limits. Environment-specific reproduction remains required before PunchOp labels a diagnostic branch as tested.