Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
SMTP error code · Yahoo / AOL

Yahoo 553 / 554 authentication failures: message rejected

554 Permanent failure (5xx): the message bounced
By iBlockSpam Team Checked against sources 2 sources How we check our content
What it means

Yahoo permanently rejected your message because it failed authentication checks against the sending domain's DMARC or DKIM policy. Don't retry until authentication is fixed.

What 554 means

Yahoo's Sender Hub lists failing authentication checks against your sending domain's DMARC or DKIM policy among the reasons for a permanent 553 or 554 error. Under its "Authentication failures" heading, Yahoo says your email failed one or more of the checks it uses to verify that mail really comes from the domain it claims.

Yahoo's baseline: all senders need to authenticate with either SPF or DKIM, and bulk senders must authenticate with SPF and DKIM and have a DMARC policy in place. Yahoo also rejects mail for failing DKIM when the signing domain (the d= tag) publishes a policy that all its mail must be DKIM-signed and the message couldn't be authenticated against that policy, for example because of a missing or bad signature.

Yahoo adds advice for two common situations. Mailing lists should put the list's own address in the From line and the real sender in Reply-To. For forwarded mail, consider ARC (Authenticated Received Chain). If you send through Microsoft 365 or Google Workspace, Yahoo points to those providers' DKIM setup guides. As with every 5xx from Yahoo, don't retry the same message unchanged.

Likely causes

  • The message failed the DMARC policy published for the From domain.
  • DKIM is missing or broken for a domain that requires all its mail to be signed.
  • A mailing list or forwarder changed the message and broke SPF or DKIM.
  • A bulk sender without SPF, DKIM and a DMARC policy.

How to fix it

If you sent the message

  1. Set up SPF and DKIM for your domain, and publish a DMARC record if you send in bulk.
  2. If you send through Microsoft 365 or Google Workspace, turn on DKIM signing with your own domain.
  3. Run mailing lists with the list's address in From and the sender in Reply-To.
  4. If you forward mail, consider adding ARC signing.

If you're the recipient or their admin

  1. No action needed at Yahoo: the sender has to fix authentication.
DMARC Checker DKIM Checker SPF Checker

Frequently asked questions

Should I retry after a Yahoo 554 authentication failure?

No. Yahoo says you shouldn't retry a message that comes back with a 5xx error. Fix SPF, DKIM or DMARC for the sending domain first, then send again.

What authentication does Yahoo require from bulk senders?

Yahoo says all senders need SPF or DKIM, and bulk senders must authenticate with both SPF and DKIM and have a DMARC policy in place.

Sources

  1. SMTP Error Codes (Yahoo Sender Hub)
  2. RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)

Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.

Related codes

Related guides

SPF, DKIM & DMARC

Gmail, Yahoo and Microsoft bulk sender requirements explained

What Gmail, Yahoo and Outlook.com require from bulk senders in 2026: SPF, DKIM, DMARC, alignment, one-click unsubscribe, spam rates and the rejection codes.

11 min read SPF, DKIM & DMARC

Why do mailing lists break DMARC, and how do you fix it?

Why mailing lists break DMARC, how list software rewrites From or wraps posts, where ARC fits, and what RFC 9989 says about p=reject when your users post to lists.

9 min read SPF, DKIM & DMARC

What is ARC (Authenticated Received Chain), and how does it work?

How ARC works: the ARC-Seal, ARC-Message-Signature and ARC-Authentication-Results headers, chain validation, how receivers use it, and where it falls short.

9 min read SPF, DKIM & DMARC

Why does DMARC fail? Causes and fixes for dmarc=fail

Troubleshoot dmarc=fail: alignment vs pass, third-party senders, forwarding, subdomains, DKIM d= and SPF MAIL FROM mismatches, with a causes-to-fixes table.

9 min read