Bounce and error codes

550 5.7.1: email rejected per DMARC policy

Last updated 2026-08-14

5.7.1 is the code receivers reach for when they do not want to be specific. If the text next to it mentions DMARC, the fix is alignment on your side, and the recipient cannot help.

The strings you will see

Gmail, on a domain publishing quarantine or reject:

A Postfix or Exim host running OpenDMARC, which is most self-hosted receivers:

Yahoo, which uses its own wording for policy rejections:

Yahoo moves its codes around more than the others, and its sender hub at senders.yahooinc.com carries the current list. If your bounce text differs by a word, trust the bounce.

Confirm it is really DMARC

Three quick checks separate a DMARC rejection from the other things wearing this code.

1. The text names DMARC, or a policy, or your domain. A 5.7.1 that says Relay access denied is a misconfigured relay and has nothing to do with authentication.
2. Your domain publishes an enforcing policy. Check it:
   dig +short TXT _dmarc.example.com
   If you get p=none back, the rejection is something else, because p=none asks receivers to deliver anyway.
3. It fails for one sending system and not others. A tool that sends through your own mail server is usually fine; the tool that sends through a vendor is usually the one.

The DMARC checker reads every tag in the record, including the ones that surprise people: sp= for subdomains, and pct=, which applies the policy to a fraction of messages and produces intermittent rejections that look like flakiness.

The usual causes

1. A vendor that was never authenticated for your domain. The single biggest one, every time.
2. A subdomain covered by an inherited policy. p=reject on the parent applies to mail.example.com unless you set sp=. Publishing a separate DMARC record on the subdomain is the clean fix, not weakening the parent.
3. Strict alignment. If you set aspf=s or adkim=s, an exact domain match is required and a subdomain no longer counts. Most people who set this did not mean to. Alignment, explained covers the difference.
4. SPF permerror. An SPF record over the lookup limit returns permerror, not pass, so DMARC has only DKIM left to work with. Details here.

Fix

Find the sending system, complete its domain authentication so it signs with d=example.com, and set a custom return-path if it offers one. Retest with a single message to a Gmail address and read Show original. If you cannot identify the system from the bounce, the aggregate reports will name it: how to read one.

If you are mid-rollout and this is breaking real mail, going back to p=none for a week is a legitimate move. It is not a failure. Rolling out DMARC and rolling straight back to reject with a broken sender still in the mix is.

You fixed this sender. Tomorrow the reports name the other hosts still sending as you, and we turn a day of XML into one email with a verdict per sender. On the paid plans, the day a report first names a new sender failing, you hear about it. Get the weekly digest. The first domain is free.