Skip to content
MailVitals Email deliverability
Sign inEarly access
Orange (orange.fr and wanadoo.fr)

OFR_535: DKIM signature missing

Orange rejected your message because it carries no DKIM signature. Orange makes DKIM signing mandatory for mail sent to its users.

Orange
Provider
Sources checked
By , email deliverability consultant
Author

At a glance

Code
OFR_535
Who has to act
The sender. The fix is on the sending side: your domain, your server or your list.

What it means

Code 535 means the message had no DKIM signature, so Orange rejected it. Orange states plainly that DKIM is mandatory, alongside SPF and DMARC, and that messages without a signature may be rejected. The signature should use your own domain, aligned with the From address, which also helps with code 988, where Orange asks senders to sign with their own DKIM domain. Orange points to the MxToolBox DKIM check to confirm the key is published and working.

Common causes

  • DKIM signing is not set up on the server or service that sent the message.
  • Signing stopped after a change of server, provider or DNS.
  • Some of your systems sign and others, such as a web form, do not.

How to fix it

  1. 01Set up DKIM signing for every system that sends mail under your domain.
  2. 02Publish the public key in DNS and check it with a DKIM lookup.
  3. 03Send a test message and confirm the DKIM result is pass.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

  1. OFR_515DMARC failed, rejected by your policy.Your message failed DMARC, and Orange rejected it because your domain's DMARC policy asks for that.Orange
  2. OFR_988Rate limited for low message reputation.Orange slowed down your messages because of a low reputation. It asks you to sign with your own DKIM domain and to try again later.Orange
  3. 451Missing or unaligned DKIM under high traffic.GMX deferred your mail because it arrived in unusual volume without a DKIM signature that matches the From domain. Sign with an aligned DKIM domain to clear it.GMX, WEB.DETemporary

Further reading

All 20 Orange codesEvery code in the wikiPaste your own bounce

Beat · paid monitoring

A heartbeat for your email.

Beat runs every check on this site on a schedule: 41 checks, 33 blacklists and real inbox placement. The moment something breaks, it tells you what broke, why it matters, and the exact fix.

Get early access to BeatSee what Beat watches
example.comWatching
  • SPFpass
  • DKIMpass
  • DMARCp=none
  • Blacklists0 of 33

Illustrative. Your domain, every few hours.

Also from us:Pulse: your own sending infrastructureConsulting: $65/hr, no retainer