Skip to content
inboxprobe

Checkers

Generators

Guides

Bounce error codes · Gmail and Google Workspace

Gmail 5.7.30: DKIM authentication didn't pass

Gmail rate-limited (4.7.30) or blocked (5.7.30) your message because it had no valid DKIM signature, which Gmail requires from bulk senders.

The exact error texts

  • 550 5.7.30 This message was blocked because it didn't pass DKIM authentication. Gmail requires bulk email senders to authenticate their email with DKIM. Authentication results: DKIM = did not pass

  • Temporary version

    421 4.7.30 Your email has been rate limited because DKIM authentication didn't pass for this message. Gmail requires all email bulk senders to authenticate their email with DKIM. Authentication results: DKIM = Did not pass.

Quoted from Google Workspace — Gmail SMTP errors and codes

Check your domain

Find out which record is missing or failing. The check runs in your browser and takes a few seconds.

What 5.7.30 means

Google requires bulk senders (more than 5,000 messages a day to Gmail) to sign with DKIM as well as pass SPF. 5.7.30 means the message reached Gmail without a DKIM signature that verified: either it wasn't signed, or the signature couldn't be checked against the key in DNS.

Common causes

  • Not signed at all. DKIM was never turned on for this domain or this sending system. In Google Workspace, DKIM needs a key generated and Start authentication clicked (how); in Microsoft 365 it's a switch in the Defender portal after the CNAMEs exist (how).
  • Public key missing. The TXT or CNAME at <selector>._domainkey was deleted, mistyped, or put on the wrong domain.
  • Key truncated. Some DNS panels cut a 2048-bit key at 255 characters. The record exists but the key doesn't parse.
  • Message changed after signing. Google warns that outbound gateways that modify messages, for example by adding a footer, can interfere with DKIM.
  • Key rotated too early. The old selector was removed while messages signed with it were still in transit or queued.

Fix it step by step

  1. In Gmail open a test message → Show original, or paste the headers into the header analyzer. Find DKIM-Signature: and read s= and d=.
  2. No DKIM-Signature header? Turn on DKIM in the system that sent it. That's the whole fix.
  3. Enter d= as the domain and s= as the selector in the check above. It decodes the public key and reports problems such as a truncated or revoked key.
  4. Key fine but still failing? Look for anything between your mail service and the internet that rewrites messages, such as a disclaimer gateway or a security appliance, and sign after it.

Questions

My sending service says DKIM is set up. Why does Gmail say it didn't pass?

Check the signature in a real message. If d= is the service's domain, it signed with its own key, which usually passes. 5.7.30 means no signature verified at all, so look for a missing or truncated key, or a gateway that changed the message.

Does a 1024-bit key cause 5.7.30?

No. 1024-bit RSA keys still verify. RFC 8301 recommends 2048 bits, and keys shorter than 1024 bits must be rejected.

How long after publishing the key does DKIM start working?

Receivers see the record once DNS has updated. For Google Workspace, Google says DKIM authentication can take up to 48 hours to start working after you add the key.

Is DKIM failing the same as DMARC failing?

Not necessarily. DMARC passes if SPF or DKIM passes aligned with From. Gmail's bulk-sender rule is stricter: DKIM itself must pass.

Sources

Last reviewed: