550 5.7.30: Gmail blocked a message that didn't pass DKIM
Gmail blocked (550) or rate limited (421 4.7.30) your message because it didn't pass DKIM authentication, which Gmail requires from bulk email senders.
550 5.7.30 This message was blocked because it didn't pass DKIM authentication. Gmail requires bulk email senders to authenticate their email with DKIM.
Start of the 5.7.30 message in Google's Gmail SMTP errors and codes reference; it continues "Authentication results: DKIM = did not pass".
What 550 5.7.30 means
Google lists two versions. 421 4.7.30 says your email has been rate limited because DKIM authentication didn't pass, and that Gmail requires all bulk senders to authenticate with DKIM. 550 5.7.30 says the message was blocked for the same reason. Both show "DKIM = did not pass" in the authentication results.
DKIM fails when the message isn't signed at all, when the public key can't be found in DNS at the selector the signature names, or when the signature doesn't verify because the message changed after signing. Google also notes that sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer and recommends 2048 bits.
Google's sender guidelines say senders of more than 5,000 messages a day to Gmail accounts must set up SPF, DKIM and DMARC, and for direct mail the From domain must align with the SPF or DKIM domain. A DKIM signature with your own domain is the most reliable way to meet that. Note that the IANA registry assigns X.7.30 to "REQUIRETLS support required" (RFC 8689); Gmail's 5.7.30 means DKIM, so go by Gmail's text.
Microsoft uses the same code for something else. Its Exchange Team says that once Basic authentication is permanently disabled for SMTP AUTH in Exchange Online, clients and apps that still sign in to smtp.office365.com with a password will receive "550 5.7.30 Basic authentication is not supported for Client Submission." That reply comes from Microsoft 365 when your device or app connects to send, not from Gmail; the fix is to move the device to OAuth or another sending method.
Likely causes
- DKIM signing isn't turned on for the domain or the sending service.
- The DKIM public key isn't published at the selector the signature uses, or the DNS record is broken.
- The message was changed after signing (body hash or header mismatch), for example by a gateway or footer tool.
- The DKIM key is shorter than 1024 bits.
How to fix it
If you sent the message
- Turn on DKIM signing with your own domain in every service that sends your mail.
- Look up the selector from the DKIM-Signature header and check that the key is published and valid.
- Use a 2048-bit key if your DNS provider supports it.
- Stop anything that modifies messages after signing, or sign after the last change.
If you're the recipient or their admin
- No action needed at Gmail: the sender has to fix DKIM signing.
Frequently asked questions
Why does Gmail return 5.7.30 when my email provider says DKIM is on?
The signature may use the provider's domain instead of yours, the key may be missing at the selector, or something changed the message after signing. Open a message you sent, read the DKIM-Signature header and check the d= domain and selector.
How long should a DKIM key be for Gmail?
Google says sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer, and recommends 2048 bits where your domain provider supports it.
Sources
- Gmail SMTP errors and codes (Google Workspace Admin Help)
- Email sender guidelines (Gmail Help)
- IANA: SMTP Enhanced Status Codes registry
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
- Microsoft Tech Community: Exchange Online to retire Basic auth for Client Submission (SMTP AUTH)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
- 550 5.7.27 550 5.7.27: Gmail blocked a message that didn't pass SPF
- 550 5.7.26 550 5.7.26: Gmail blocked an unauthenticated message
- 421 4.7.32 421 4.7.32 / 5.7.32: From header not aligned with SPF or DKIM
- 550 5.7.29 550 5.7.29: Gmail blocked a message not sent over TLS
- 550 5.7.40 550 5.7.40: Gmail blocked mail from a domain without a DMARC policy
- 550 5.7.24 550 5.7.24: the sending domain's SPF record has suspicious entries
- 552 5.7.0 Gmail 552 5.7.0: content presents a potential security issue
Related guides
What is DKIM, and how does a DKIM signature work?
What DKIM is, how a signature is created and verified, what d=, s=, h=, bh= and b= mean, how selectors, key length and Ed25519 work, and why DKIM fails.
10 min read SPF, DKIM & DMARCDKIM "body hash did not verify" and other DKIM failures: causes and fixes
Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.
9 min read SPF, DKIM & DMARCHow to find a domain's DKIM selector, and check its key
Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.
8 min read SPF, DKIM & DMARCHow to set up DKIM in Microsoft 365 and Google Workspace
Step-by-step DKIM setup for Microsoft 365 (two CNAME selectors) and Google Workspace (one TXT key): 2048-bit keys, key rotation and how to verify it works.
9 min read SPF, DKIM & DMARCGmail, Yahoo and Microsoft bulk sender requirements explained
What Gmail, Yahoo and Outlook.com require from bulk senders in 2026: SPF, DKIM, DMARC, alignment, one-click unsubscribe, spam rates and the rejection codes.
11 min read