Skip to content
notspoofed.comSPF · DKIM · DMARC

5.7.9: authentication required or signature invalid

By · Published

Hard bounceYour authentication setup

The error

550 5.7.9 Message not accepted for policy reasons

550 5.7.9 DKIM signature did not verify

What it means

The receiver required authentication that was absent or invalid — commonly a DKIM signature that did not verify.

Your mail is not proving it came from you. SPF, DKIM or DMARC is missing or failing.

Why it happens

A DKIM signature that verified when you sent it can fail on arrival if anything modified the message in transit. A mailing list that appends a footer or rewrites the subject breaks the body hash, and the signature then fails legitimately.

How to fix it

  1. Confirm the DKIM public key is published and matches the selector in the signature.
  2. Check whether anything is modifying the message after signing — a gateway, a footer appender, or a mailing list.
  3. Verify the signing key is at least 1024 bits, and preferably 2048.

Not sure which selector the failing signature used? Find your selector tests the names every major provider publishes and reports the key it finds.

Related guides

  • 5.7.509: rejected by the DMARC policy — The From domain publishes a DMARC policy of reject or quarantine, and this message did not pass an aligned SPF or DKIM check, so the receiver honoured that policy.
  • Gmail 550 5.7.26: this mail is unauthenticated — Gmail rejected the message because it could not verify that you sent it. Gmail requires every sender to pass either SPF or DKIM, aligned with the domain in your From address, and this message passed neither.
  • Microsoft 5.7.23: SPF violation — The receiving Microsoft system checked your SPF record and the sending IP was not authorised by it.