550 5.7.1: blocked by a domain policy
A rule set by the recipient's or the sender's Google Workspace admin blocks this message, so Gmail rejected it under that policy.
- Gmail
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 550 5.7.1
- Provider
- Gmail and Google Workspace
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- Either side, depending on the cause. Start with the checks below that are yours.
- What the server says
550 5.7.1 The user or domain that you are sending to (or from) has a policy…
What it means
Workspace admins can write rules that block messages by sender, recipient, content, attachment and other conditions. Your message matched one, either at the recipient's organization or, if you send from Workspace, at your own. When an admin's custom rule causes the rejection, Gmail adds 'gcdp' (Google Custom Domain Policies) to the error next to 'gsmtp', and the text may name the domain's own policy. Only the admin who owns the rule can change it, which is why Google's reply says to contact your domain administrator.
Common causes
- A content compliance or attachment rule set by the recipient's Workspace admin.
- A rule restricting who may send to a group or user, such as an internal-only address.
- A rule on your own Workspace domain that restricts outgoing mail.
How to fix it
- 01Look for gcdp in the bounce to confirm that an admin rule caused it.
- 02If you send from Workspace, ask your own admin whether an outbound rule matched.
- 03Otherwise contact the recipient another way and ask their admin to review the rule or allow your mail.
- 04If you know what triggered the rule, such as an attachment type, resend without it.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Gmail SMTP errors and codes (Google Workspace Admin Help)knowledge.workspace.google.com
Related codes
- 550Mailbox unavailable.The receiving server permanently refused the message for this recipient: the mailbox does not exist, cannot be reached, or the server rejected the message by policy.
- 5.7.1Delivery not authorised.The receiving server refuses the message because this sender is not allowed to send to this recipient, as a result of filtering by host or by recipient.
5.7.1 at other providers
- 550 5.7.1Not authorized to send to this recipient.You do not have permission to send to this recipient, typically a group restricted to certain senders or a recipient protected by a mail flow rule.
- 550 5.7.1Public folder does not accept external mail.An external sender wrote to a mail-enabled public folder in Microsoft 365, which by default accepts mail only from authenticated senders.
- 550 5.7.1Sending IP blocked by Proofpoint Dynamic Reputation.Proofpoint’s IP reputation system has your sending IP on its block list because it has seen spam or viruses from it, so Proofpoint customers refuse your mail.
- 550 5.7.1SPF check failed.The recipient’s Cisco Secure Email gateway checked SPF, found your server not authorised for the sender domain, and its policy rejects that result.
- 550 5.7.1Rejected under your domain’s DMARC policy.Your message failed DMARC, your domain’s DMARC record asks receivers to reject such mail, and the recipient’s Cisco gateway did so.
- 550 5.7.1DMARC verification failed permanently.The Cisco gateway hit a permanent failure while verifying DMARC for your message, and the recipient’s policy rejects such mail. Cisco does not say what produces that failure.
All 108 Gmail codesEvery code in the wikiPaste your own bounce