554: failed authentication
Yahoo or AOL refused the message because it failed the checks that confirm the sending domain, such as DKIM against the domain's policy. Yahoo lists this among its permanent 553 and 554 errors.
- Yahoo
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 554
- Provider
- Yahoo and AOL
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
What it means
Yahoo checks that mail really comes from the domain it claims. Every sender must authenticate with SPF or DKIM; bulk senders need both, plus a DMARC policy, with the From domain aligned to the SPF or DKIM domain. Yahoo rejects for failed DKIM when the signing domain (the d= in the signature) publishes a policy requiring signed mail and the message could not be verified against it, for example because the signature is missing or broken. Yahoo gives no single code for these failures: it lists a failed DMARC or DKIM check among the reasons for its permanent 553 and 554 errors, so go by the wording of the reply. Forwarding and mailing lists can break authentication: Yahoo suggests that lists put their own address in From, and that forwarders add ARC.
Common causes
- The message has no DKIM signature, or one that fails, while the signing domain requires signed mail.
- Neither SPF nor DKIM passes in alignment with the From domain, and the domain's DMARC policy says to reject.
- A mailing list or forwarder changed the message or relayed it from servers your SPF record does not cover.
- A service sending for you, such as an ESP, Microsoft 365 or Google Workspace, is not set up to sign with your domain.
How to fix it
- 01Check SPF, DKIM and DMARC for the From domain and confirm they pass for this mail stream, not only for your main server.
- 02Turn on DKIM signing with your own domain in every service that sends for you. Yahoo's page links Google's and Microsoft's setup guides.
- 03As a bulk sender, publish SPF and DKIM together with a DMARC record of at least p=none, aligned with the From domain.
- 04For a mailing list, put the list's address in From and the original sender in Reply-To.
- 05If you forward mail, add ARC headers so Yahoo can see the original authentication results.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- SMTP Error Codes (Yahoo Sender Hub)senders.yahooinc.com
- Sender Requirements & Recommendations (Yahoo Sender Hub)senders.yahooinc.com
Related codes
- 553Permanent rejection (553).Yahoo or AOL rejected the message for good with a 553. Yahoo groups 553 with 554 as its permanent errors, so retrying will not help until the cause is fixed.
- 554Permanent rejection (554).Yahoo or AOL rejected the message for good with a 554. Yahoo uses this code for several problems, from failed authentication to unacceptable content, so the wording of the reply tells you which.
- 554Transaction failed.The server permanently refused the transaction, often after receiving the message data or straight away when the connection opened.
554 at other providers
- 554No reverse DNS (PTR) record.Xfinity refused the connection because your sending IP has no PTR record. Every server sending to Xfinity needs valid reverse DNS, so the owner of the IP must add one.
- 554Rejected for breaking GMX guidelines.GMX refused the message permanently because the connection broke its guidelines. GMX points to its requirements page and asks for the full error message if the problem continues.
- 554IP address on the GMX blocklist.Your sending IP is on a blocklist that GMX manages itself, so its servers refuse the connection. GMX keeps a strict no tolerance policy toward spam.
- 554IP address on a Spamhaus blocklist.GMX refused the connection because your sending IP is listed on a Spamhaus blocklist. GMX makes no exceptions; the listing has to be removed at Spamhaus.
- 554Reverse DNS does not meet GMX requirements.GMX refused the connection because the reverse DNS (PTR) record of your IP looks generic or dynamic. GMX expects a fixed IP with its own mail host name.
- 554No reverse DNS for your IP.GMX refused the connection because the IP address of your mail server has no PTR record, so it is not tied to any domain name in DNS.
Further reading
All 7 Yahoo codesEvery code in the wikiPaste your own bounce