T-Online "554 IP=... A problem occurred" (tosa@rx.t-online.de): fix it

What it means

Deutsche Telekom runs the mail servers for t-online.de addresses (and other Telekom domains such as magenta.de). When they refuse your sending IP address, the connection ends with a message like this (the exact punctuation varies):

554 IP=203.0.113.25 - A problem occurred. (Ask your postmaster for help
or to contact tosa@rx.t-online.de to clarify.)

Some versions add a short tag such as (BL). The 554 code means a permanent refusal at connection time: your IP address is blocked, not a single message. Your server will not retry, and every email to T-Online fails until the block is lifted.

Why it happens

T-Online is known to be strict. Its postmaster page (postmaster.t-online.de) lists the rules senders must follow. The most common reasons for this block are:

• No proper reverse DNS. The IP must have a PTR record with a real hostname in a domain that belongs to the server's operator, and that hostname must resolve back to the same IP (forward-confirmed reverse DNS). Generic names like 203-0-113-25.vps.example.net are a frequent cause.
• No contact information. T-Online expects the domain of your server's hostname to have a website where an imprint or contact details are easy to find.
• New or unknown IP. A fresh VPS or cloud IP without history is often blocked by default.
• Shared or cloud ranges. IPs from some cloud and shared providers can be blocked because of other customers.
• Spam or list problems. Complaints, mail to old addresses, bounces or a compromised account on your server.

How to check

1. Read the bounce. Note the IP shown after IP=. This is the server T-Online sees, which may differ from your web server.
2. Run a Delivmail test. On the home page (/), send an email to your unique address from the same server. The report shows the sending IP, its reverse DNS (PTR) and whether it matches the forward lookup, plus SPF, DKIM and DMARC.
3. Check blacklists for that IP on the blacklist checker, and look up who owns it with Whois.
4. Check the PTR yourself:

   dig -x 203.0.113.25 +short
   mail.yourdomain.com.
   dig mail.yourdomain.com A +short
   203.0.113.25

   Both answers must match. Then open https://yourdomain.com and make sure a contact or imprint page is easy to find.

How to fix it

1. Fix reverse DNS and the hostname

Ask your hosting company to set the PTR of the sending IP to a hostname in your own domain, for example mail.yourdomain.com, and create the matching A record. See how to set reverse DNS at your hosting company. Use the same name in your server's HELO/EHLO greeting, for example in Postfix:

myhostname = mail.yourdomain.com
smtp_helo_name = $myhostname

2. Publish contact details

Make sure yourdomain.com has a working website with an imprint or contact page (company name, postal address, an email address). This matters a lot for German mailbox providers.

3. Clean up your sending

• Authenticate with SPF, DKIM and DMARC.
• Send only to people who opted in (double opt-in is expected in Germany), and remove hard bounces and long-inactive addresses.
• Do not send newsletters with recipients in BCC, and include an unsubscribe link.
• If the IP is on a public blacklist, find and fix the cause first, then request delisting.

4. Ask T-Online to lift the block

Once everything above is in place, contact Telekom. Their postmaster page offers a contact form (postmaster.t-online.de, "Contact"), and the bounce names tosa@rx.t-online.de. Write in English or German and include:

• the sending IP and its hostname (PTR);
• the full bounce line with date and time;
• your domain and a link to your imprint/contact page;
• a short description of what you send and how recipients signed up.

Telekom says it does not offer whitelisting, so the goal is only to remove the block. Answers can take a few days.

If you cannot control the IP

On shared hosting or some cloud platforms you cannot set the PTR or clean the IP's history. In that case, send through a reputable email service or a smarthost with good reputation instead, or ask your provider to contact T-Online. A shared IP with a bad reputation is a common reason.

Check that it is fixed

Run a new Delivmail test and confirm that the PTR matches, the HELO name is valid and SPF, DKIM and DMARC pass. After Telekom confirms the removal, send one email to the T-Online address that bounced and check your mail log for a 250 answer. Keep volumes low for a while: a new IP should be warmed up. Delivery is never guaranteed, but these steps address what T-Online checks.