550 5.7.20: no valid DKIM signature
The receiving server requires a valid DKIM signature and found none that passed verification, so it refused the message.
- Standard
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550 5.7.20
- Provider
- Standard SMTP codes
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 5.7.20 No passing DKIM signature found
What it means
RFC 7372 added X.7.20 for messages that carry no DKIM signature that passes verification: either they are not signed at all, or every signature failed. The RFC pairs it with reply 550, so the refusal is permanent and the message is returned. RFC 6376 advises receivers not to treat unsigned mail specially, and RFC 7372 acknowledges that some operators do it anyway; this code lets them say so. Signatures typically fail because something altered the message after signing, or because the public key published under the signature's selector does not match the key that signed.
Common causes
- The sending service does not sign mail with DKIM for your domain.
- The DKIM public key is missing from DNS, or the key published under the signature's selector does not match the signing key.
- The message was changed after signing, for example by a footer or link rewriting.
How to fix it
- 01Turn on DKIM signing in your sending service and publish the key it gives you.
- 02Look up the DKIM record for the selector shown in your message's DKIM-Signature header.
- 03Send a test to a mailbox you control and check the DKIM result in its headers.
- 04Make sure nothing modifies messages after they are signed.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 550 5.7.21No acceptable DKIM signature.The message has at least one DKIM signature that verifies, but none meets the receiving server's own requirements, so it was refused.
- 550 5.7.22No DKIM signature from the From domain.The message has DKIM signatures that verify, but none is from the domain in the From header, which the receiving server requires.
- 550 5.7.26Multiple authentication checks failed.The message failed more than one authentication check, for example SPF and DKIM, and the receiving server's policy rejects it.
- 5.7.7Message integrity check failed.A system authorised to validate the message found it corrupted or altered, so the check on its integrity failed.
Further reading
All 105 standard codesEvery code in the wikiPaste your own bounce