550 5.7.1: rejected under your domain’s DMARC policy
Your message failed DMARC, your domain’s DMARC record asks receivers to reject such mail, and the recipient’s Cisco gateway did so.
- Cisco Secure Email
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550 5.7.1
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
550 5.7.1 #5.7.1 DMARC unauthenticated mail is prohibited
What it means
Cisco Secure Email Gateway verifies DMARC with a profile that says what to do when the policy in the sender’s DMARC record is reject. When the gateway honours it, the message is refused with this default reply. A message passes DMARC if SPF or DKIM passes for a domain aligned with the visible From domain. So this rejection is your own domain’s instruction being carried out: something sent mail using your From domain without aligned authentication. Either that is a legitimate source you have not set up, or someone is spoofing your domain and the policy is working.
Common causes
- A legitimate sending service is not covered by your SPF record and does not sign DKIM with your domain.
- Forwarding or a mailing list broke SPF and DKIM on the way.
- Someone else is sending with your domain in the From address.
How to fix it
- 01Read your DMARC aggregate reports to see which sources fail.
- 02For each legitimate source, add it to SPF and set up DKIM signing with your domain.
- 03Confirm a test message passes DMARC before resending.
- 04Keep the reject policy once your own sources pass; it protects the domain from spoofing.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 550Mailbox unavailable.The receiving server permanently refused the message for this recipient: the mailbox does not exist, cannot be reached, or the server rejected the message by policy.
- 5.7.1Delivery not authorised.The receiving server refuses the message because this sender is not allowed to send to this recipient, as a result of filtering by host or by recipient.
- 550 5.7.1DMARC verification failed permanently.The Cisco gateway hit a permanent failure while verifying DMARC for your message, and the recipient’s policy rejects such mail. Cisco does not say what produces that failure.
- 451 4.7.1DMARC could not be checked.A temporary failure stopped the Cisco gateway from verifying DMARC for your message, and its policy defers such mail, so your server should retry.
5.7.1 at other providers
- 550 5.7.1Blocked by a domain policy.A rule set by the recipient's or the sender's Google Workspace admin blocks this message, so Gmail rejected it under that policy.
- 550 5.7.1Relay IP does not match the sending domain.Google's SMTP relay knows your IP, but the mail's sending domain is not one that IP is registered to relay for in your Workspace account.
- 550 5.7.1Blocked as likely spam.Gmail's filters judged this message likely to be spam and rejected it outright, instead of delivering it to the spam folder.
- 550 5.7.1IPv6 sender without PTR or authentication.Gmail rejected mail that arrived over IPv6 because the sending address lacks a matching PTR record, or the message failed authentication.
- 550 5.7.1Blocked for low IP reputation.Gmail permanently rejected the message because the IP it came from has a very low reputation with Gmail.
- 550 5.7.1Blocked for low domain reputation.Gmail permanently rejected the message because the domain it comes from has a very low reputation with Gmail.
Further reading
All 7 Cisco Secure Email codesEvery code in the wikiPaste your own bounce