Documentation
Bounced for failed authentication: SPF, DKIM, DMARC.
The receiver could not confirm that your domain really sent the message.
What it means
Receivers check that a message is authorised by the domain it claims to come from, using SPF (which servers may send), DKIM (a signature on the message) and DMARC (the policy that ties them to the From address). When the checks fail, the reply carries one of the 5.7.2x codes: 5.7.23 means SPF validation failed, 5.7.25 means reverse DNS validation failed, 5.7.26 means multiple authentication checks failed, and 5.7.27 means the sender address has a null MX.
Typical codes and wording
550 5.7.23, 5.7.25, 5.7.26, 5.7.27 (SPF, DKIM, DMARC, reverse DNS)
Common causes
- The sending domain is not verified, so its DKIM records are not published.
- The From address uses a different domain from the one that is verified and signs the mail (DMARC alignment fails).
- An SPF record that does not include the sending service, or that has too many lookups.
- DNS records were published but have not propagated, or were published at the wrong name (for example with a proxied record where it must be DNS only).
What to do
- Open the sending domain's page and confirm every record shows Verified: see Verifying a domain.
- Send from an address on the verified domain, so the From domain, the signing domain and the return path line up.
- If you publish your own SPF record, make sure it still includes everything that sends for the domain, and stays under the ten-lookup limit.
- Check the DMARC record's policy. A strict policy (reject) on a domain whose mail does not pass will cause rejections.
- After changing DNS, re-check the domain and send a test.
What Mailtruss shows
Titled "Your sending domain failed the receiver's authentication check", with a button to open the domain's DNS setup. It is a permanent bounce, so the address is suppressed; remove it after you have fixed the cause.
Is it safe to retry?
Only after the authentication problem is fixed.