Skip to content
inboxprobe

Checkers

Generators

Guides

Bounce error codes · Gmail and Google Workspace

Gmail 5.7.40: no DMARC record or policy

Gmail requires bulk senders to publish DMARC for their sending domain. Gmail couldn't find a DMARC record for yours, or found one without a policy.

The exact error texts

  • 550 5.7.40 Your message was blocked because the sending domain doesn't have a DMARC record or the DMARC record doesn't specify a DMARC policy. Gmail requires all bulk email senders to add a DMARC record to their sending domain. See Set up DMARC. To learn more about Gmail requirements for bulk email senders, visit Email sender guidelines.

  • Temporary version

    421 4.7.40 Your email has been rate limited because the sending domain doesn't have a DMARC record, or the DMARC record doesn't specify a DMARC policy. Gmail requires all bulk email senders to add a DMARC record to their sending domain.

Quoted from Google Workspace — Gmail SMTP errors and codes

Check your domain

Find out which record is missing or failing. The check runs in your browser and takes a few seconds.

What 5.7.40 means

Since February 2024 Google requires anyone sending more than 5,000 messages a day to Gmail to publish DMARC. The policy can be none, but it must be there. 5.7.40 is the dedicated code for “no usable DMARC record”, separate from alignment (5.7.32) and from failing an existing policy (5.7.26).

Why Gmail doesn't see your record

  • Wrong host name. DMARC lives at _dmarc.yourdomain.com, not at the root. In most DNS panels the host field is just _dmarc. Some panels append the domain automatically, so typing _dmarc.yourdomain.com creates _dmarc.yourdomain.com.yourdomain.com.
  • No policy. A record without p= doesn't specify a policy, and the bounce text says so.
  • Two records. Two TXT records starting with v=DMARC1 on the same name count as no record.
  • Typos. The record must start with v=DMARC1. Variants such as DMARC=1, or stray quotes copied from a guide, make it invalid.
  • Sending from a different domain. The record must cover the domain in your From address. A subdomain without its own record uses the organisational domain's.

The record to publish

Meets the requirement

Type
TXT
Host / name
_dmarc
Value
v=DMARC1; p=none; rua=mailto:[email protected]

Google recommends starting at p=none with a report address and moving to quarantine and reject once the reports show all your mail passing. The DMARC generator builds each stage, and the DMARC checker confirms what receivers see.

Gmail also uses 5.7.40 with reply code 504 for “Unrecognized authentication type”. That's a problem logging in to Gmail's SMTP server, not DMARC.

Questions

Is p=none enough to stop 5.7.40?

Yes. Google's requirement says the DMARC enforcement policy can be set to none. You still need SPF or DKIM aligned with From, or you'll see 5.7.32 instead.

I just added the record. Why do I still get the bounce?

DNS changes take time to be seen everywhere, up to the TTL of any cached answer. Check what public resolvers return with the DMARC checker, then retry.

Do I need a DMARC record for each subdomain?

No. A subdomain with no record of its own falls back to the organisational domain's record. Add one only when a subdomain needs a different policy.

Where should DMARC reports go?

Any mailbox you read, or a DMARC reporting service. If the address is at another domain, that domain has to authorise it; our DMARC check tells you if that's missing.

Sources

Last reviewed: