550 5.7.21: no acceptable DKIM signature
The message has at least one DKIM signature that verifies, but none meets the receiving server's own requirements, so it was refused.
- Standard
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550 5.7.21
- Provider
- Standard SMTP codes
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 5.7.21 No acceptable DKIM signature found
What it means
RFC 7372 distinguishes passing signatures (the cryptography checks out) from acceptable ones (they also meet local requirements). X.7.21 says the message had passing DKIM signatures, but none was acceptable. RFC 7372's examples of such requirements are that certain header fields be signed and that partial signatures be refused; a receiver might also set a minimum key size. The RFC pairs it with reply 550, so the refusal is permanent. The reply text, if any, may say which requirement failed.
Common causes
- A signature that does not cover header fields the receiver requires, such as Subject or Date.
- A signature with a body length limit (the l= tag) that leaves part of the body unsigned.
- A signature made with a key shorter than the receiver requires.
How to fix it
- 01Check which header fields your DKIM signature covers (the h= tag) and include at least From, To, Subject and Date.
- 02Stop using the l= body length tag.
- 03Sign with rsa-sha256 and a 2048-bit key.
- 04Read the reply text for the requirement that failed.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 550 5.7.20No valid DKIM signature.The receiving server requires a valid DKIM signature and found none that passed verification, so it refused the message.
- 550 5.7.22No DKIM signature from the From domain.The message has DKIM signatures that verify, but none is from the domain in the From header, which the receiving server requires.
- 550 5.7.26Multiple authentication checks failed.The message failed more than one authentication check, for example SPF and DKIM, and the receiving server's policy rejects it.
Further reading
All 105 standard codesEvery code in the wikiPaste your own bounce