550 5.7.1: DMARC verification failed permanently
The Cisco gateway hit a permanent failure while verifying DMARC for your message, and the recipient’s policy rejects such mail. Cisco does not say what produces that failure.
- Cisco Secure Email
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550 5.7.1
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 5.7.1 #5.7.1 DMARC verification failed
What it means
Cisco’s DMARC profiles treat a permanent failure during verification separately from a message that simply fails the policy. The administrator chooses whether to accept such messages or reject them, and a rejection uses this default reply. Cisco’s guide does not list what causes a permanent failure. It does say the gateway skips DMARC verification for domains with malformed DMARC records, so a broken DMARC record is not the likely trigger here. A permanent error in a check DMARC relies on, such as an SPF record that cannot be evaluated, is a reasonable place to start, and the recipient’s administrators can see the exact result in the gateway’s DMARC logs.
Common causes
- Possibly a permanent error in the SPF check underneath, such as an SPF record with a syntax error or too many DNS lookups.
- Possibly a DKIM signature or public key record that cannot be used.
How to fix it
- 01Check the SPF record of your envelope sender domain for syntax errors and the 10 DNS lookup limit.
- 02Check that the DKIM public key records your messages point to are published and valid.
- 03Send a test message, confirm DMARC passes, then resend.
- 04If everything passes and the rejection continues, ask the recipient’s IT team to look up the result in their gateway’s DMARC logs.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 550Mailbox unavailable.The receiving server permanently refused the message for this recipient: the mailbox does not exist, cannot be reached, or the server rejected the message by policy.
- 5.7.1Delivery not authorised.The receiving server refuses the message because this sender is not allowed to send to this recipient, as a result of filtering by host or by recipient.
- 550 5.7.1Rejected under your domain’s DMARC policy.Your message failed DMARC, your domain’s DMARC record asks receivers to reject such mail, and the recipient’s Cisco gateway did so.
5.7.1 at other providers
- 550 5.7.1Blocked by a domain policy.A rule set by the recipient's or the sender's Google Workspace admin blocks this message, so Gmail rejected it under that policy.
- 550 5.7.1Relay IP does not match the sending domain.Google's SMTP relay knows your IP, but the mail's sending domain is not one that IP is registered to relay for in your Workspace account.
- 550 5.7.1Blocked as likely spam.Gmail's filters judged this message likely to be spam and rejected it outright, instead of delivering it to the spam folder.
- 550 5.7.1IPv6 sender without PTR or authentication.Gmail rejected mail that arrived over IPv6 because the sending address lacks a matching PTR record, or the message failed authentication.
- 550 5.7.1Blocked for low IP reputation.Gmail permanently rejected the message because the IP it came from has a very low reputation with Gmail.
- 550 5.7.1Blocked for low domain reputation.Gmail permanently rejected the message because the domain it comes from has a very low reputation with Gmail.
Further reading
All 7 Cisco Secure Email codesEvery code in the wikiPaste your own bounce