GMX, WEB.DE and mail.com · permanent error
554: DKIM-Signature header has invalid syntax
GMX refused the message because its DKIM-Signature header does not follow the syntax that RFC 6376 defines for it, so the header itself is malformed.
- GMX, WEB.DE
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 554
- Provider
- GMX, WEB.DE and mail.com
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
554 Transaction failed
What it means
RFC 6376 defines the syntax of the DKIM-Signature header: its tags, such as v, a, d, s, h, bh and b, and how they are written. Case r0708 means the header in your message breaks that syntax, so GMX rejects the message with 554. The usual cause is the signing software or something that altered the header after signing, such as a gateway that wraps or rewrites long headers incorrectly.
Common causes
- A signing tool or plugin writes a malformed DKIM-Signature header.
- A gateway after the signer rewrapped or truncated the header.
- A hand-built signature has missing or misspelled tags.
How to fix it
- 01Look at the DKIM-Signature header in the raw message and check it against RFC 6376.
- 02Update or reconfigure the signing software.
- 03Make sure nothing in the sending path changes the header after signing, then send again.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 554Too many copies of one header field.GMX refused the message because one header field, such as DKIM-Signature, List-Unsubscribe or Resent-From, appears more often than GMX accepts.
- 451Missing or unaligned DKIM under high traffic.GMX deferred your mail because it arrived in unusual volume without a DKIM signature that matches the From domain. Sign with an aligned DKIM domain to clear it.
- 554Transaction failed.The server permanently refused the transaction, often after receiving the message data or straight away when the connection opened.
554 at other providers
- 554Permanent rejection (554).Yahoo or AOL rejected the message for good with a 554. Yahoo uses this code for several problems, from failed authentication to unacceptable content, so the wording of the reply tells you which.
- 554Failed authentication.Yahoo or AOL refused the message because it failed the checks that confirm the sending domain, such as DKIM against the domain's policy. Yahoo lists this among its permanent 553 and 554 errors.
- 554Recipient does not exist.The Yahoo or AOL account you wrote to does not exist. The failure is permanent: check the address with the recipient, and remove it from any list.
- 554No reverse DNS (PTR) record.Xfinity refused the connection because your sending IP has no PTR record. Every server sending to Xfinity needs valid reverse DNS, so the owner of the IP must add one.
- 554No reverse DNS for your IP.IONOS refused your mail because the IP address of your mail server has no domain name assigned to it in DNS (no PTR record).
- 554Reverse DNS does not meet IONOS policy.IONOS refused your mail because the PTR record of your IP does not meet its policy, typically a generic or dynamic-looking provider name.
Further reading
All 57 GMX, WEB.DE codesEvery code in the wikiPaste your own bounce