# 550 5.7.30: Gmail blocked a message that didn't pass DKIM URL: https://iblockspam.com/smtp-errors/550-5-7-30 Last updated: 2026-11-03 Code: 550 5.7.30 (permanent failure, the message bounced) Provider: Gmail / Google Workspace Gmail blocked (550) or rate limited (421 4.7.30) your message because it didn't pass DKIM authentication, which Gmail requires from bulk email senders. What the bounce says: ``` 550 5.7.30 This message was blocked because it didn't pass DKIM authentication. Gmail requires bulk email senders to authenticate their email with DKIM. ``` Start of the 5.7.30 message in Google's Gmail SMTP errors and codes reference; it continues "Authentication results: DKIM = did not pass". Google lists two versions. 421 4.7.30 says your email has been rate limited because DKIM authentication didn't pass, and that Gmail requires all bulk senders to authenticate with DKIM. 550 5.7.30 says the message was blocked for the same reason. Both show "DKIM = did not pass" in the authentication results. DKIM fails when the message isn't signed at all, when the public key can't be found in DNS at the selector the signature names, or when the signature doesn't verify because the message changed after signing. Google also notes that sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer and recommends 2048 bits. Google's sender guidelines say senders of more than 5,000 messages a day to Gmail accounts must set up SPF, DKIM and DMARC, and for direct mail the From domain must align with the SPF or DKIM domain. A DKIM signature with your own domain is the most reliable way to meet that. Note that the IANA registry assigns X.7.30 to "REQUIRETLS support required" (RFC 8689); Gmail's 5.7.30 means DKIM, so go by Gmail's text. Microsoft uses the same code for something else. Its Exchange Team says that once Basic authentication is permanently disabled for SMTP AUTH in Exchange Online, clients and apps that still sign in to smtp.office365.com with a password will receive "550 5.7.30 Basic authentication is not supported for Client Submission." That reply comes from Microsoft 365 when your device or app connects to send, not from Gmail; the fix is to move the device to OAuth or another sending method. ## Common causes - DKIM signing isn't turned on for the domain or the sending service. - The DKIM public key isn't published at the selector the signature uses, or the DNS record is broken. - The message was changed after signing (body hash or header mismatch), for example by a gateway or footer tool. - The DKIM key is shorter than 1024 bits. ## How to fix it (sender) - Turn on DKIM signing with your own domain in every service that sends your mail. - Look up the selector from the DKIM-Signature header and check that the key is published and valid. - Use a 2048-bit key if your DNS provider supports it. - Stop anything that modifies messages after signing, or sign after the last change. ## How to fix it (recipient or admin) - No action needed at Gmail: the sender has to fix DKIM signing. **Q: Why does Gmail return 5.7.30 when my email provider says DKIM is on?** The signature may use the provider's domain instead of yours, the key may be missing at the selector, or something changed the message after signing. Open a message you sent, read the DKIM-Signature header and check the d= domain and selector. **Q: How long should a DKIM key be for Gmail?** Google says sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer, and recommends 2048 bits where your domain provider supports it. Sources: - Gmail SMTP errors and codes (Google Workspace Admin Help): https://knowledge.workspace.google.com/admin/support/troubleshooting/gmail-smtp-errors-and-codes - Email sender guidelines (Gmail Help): https://support.google.com/mail/answer/81126 - IANA: SMTP Enhanced Status Codes registry: https://www.iana.org/assignments/smtp-enhanced-status-codes/smtp-enhanced-status-codes.xhtml - RFC 6376: DomainKeys Identified Mail (DKIM) Signatures: https://www.rfc-editor.org/rfc/rfc6376 - Microsoft Tech Community: Exchange Online to retire Basic auth for Client Submission (SMTP AUTH): https://techcommunity.microsoft.com/blog/exchange/exchange-online-to-retire-basic-auth-for-client-submission-smtp-auth/4114750 --- Source: iBlockSpam, https://iblockspam.com/smtp-errors/550-5-7-30 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt