554: rejected under the sender domain's DMARC policy
The message failed SPF and DKIM as DMARC requires, and the From domain publishes p=reject, so GMX rejected it as the domain owner asked.
- GMX, WEB.DE
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 554
- Provider
- GMX, WEB.DE and mail.com
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
554 Reject due to sender domain's DMARC policy
What it means
DMARC lets a domain owner tell receivers what to do with mail that uses the domain in the From address but passes neither aligned SPF nor aligned DKIM. With p=reject the answer is to refuse it, and GMX is moving to do so (case r2001 carries a May 2026 notice that GMX is gradually moving from filing such mail as spam to rejecting it). Cases r2001 and r2004 mean your message failed those checks. If you are a user and not the domain administrator, GMX suggests asking your email provider to fix authentication. Administrators should repair DKIM and SPF and read the DMARC aggregate reports for the cause.
Common causes
- The message was not DKIM signed, or signed with a domain that does not align with the From domain.
- The sending server is not in the SPF record of the envelope domain, or that domain does not align.
- A mailing list or forwarder changed the message and broke its DKIM signature.
- Someone else sent mail using your domain in the From address.
How to fix it
- 01Check the DMARC, SPF and DKIM results for one of the rejected messages.
- 02Sign outgoing mail with DKIM under the From domain, and add every legitimate sending service to SPF.
- 03Set up rua reporting in your DMARC record and use the aggregate reports to find failing sources.
- 04If you run a mailing list, follow your list software guidance for DMARC, such as rewriting the From address.
- 05To ask GMX about the exact cause in a specific case, use the case page form and give the full error as text.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
- 451Missing or unaligned DKIM under high traffic.GMX deferred your mail because it arrived in unusual volume without a DKIM signature that matches the From domain. Sign with an aligned DKIM domain to clear it.
- 554Transaction failed.The server permanently refused the transaction, often after receiving the message data or straight away when the connection opened.
554 at other providers
- 554Permanent rejection (554).Yahoo or AOL rejected the message for good with a 554. Yahoo uses this code for several problems, from failed authentication to unacceptable content, so the wording of the reply tells you which.
- 554Failed authentication.Yahoo or AOL refused the message because it failed the checks that confirm the sending domain, such as DKIM against the domain's policy. Yahoo lists this among its permanent 553 and 554 errors.
- 554Recipient does not exist.The Yahoo or AOL account you wrote to does not exist. The failure is permanent: check the address with the recipient, and remove it from any list.
- 554No reverse DNS (PTR) record.Xfinity refused the connection because your sending IP has no PTR record. Every server sending to Xfinity needs valid reverse DNS, so the owner of the IP must add one.
- 554No reverse DNS for your IP.IONOS refused your mail because the IP address of your mail server has no domain name assigned to it in DNS (no PTR record).
- 554Reverse DNS does not meet IONOS policy.IONOS refused your mail because the PTR record of your IP does not meet its policy, typically a generic or dynamic-looking provider name.
Further reading
All 57 GMX, WEB.DE codesEvery code in the wikiPaste your own bounce