Blog
Gmail 550 5.7.30: fix DKIM authentication failed
Reviewed by the Free Domain Mail editorial team · Updated
Gmail returns 550 5.7.30 when a message that is subject to its sender requirements does not pass DKIM authentication. The repair must connect the selector in the message signature to the public key for the same signing domain.
Capture the failed signature details
Copy the full bounce and inspect a message from the same sending path if one is available. In DKIM-Signature, d= is the signing domain and s= is the selector. Together they form s._domainkey.d for the public lookup.
Do not assume the visible From domain is the DKIM signing domain. Providers can sign with a service domain until custom-domain DKIM is enabled. DMARC alignment is a separate check after cryptographic verification succeeds.
Confirm the selector exists in public DNS
Query the exact selector and signing domain. The answer may be a TXT record containing a DKIM public key or a CNAME to the provider's key hostname. NXDOMAIN, an empty key or a CNAME pointing to a missing target prevents validation.
Check authoritative nameservers before editing. Common mistakes include publishing at the registrar while another provider hosts DNS, entering the full domain into a panel that appends it again, omitting _domainkey or proxying a CNAME through an HTTP proxy.
Compare DNS with the active sending provider
Open the sending provider's domain-authentication screen and compare every character of the current selector and target. Providers rotate selectors, so an old public record can exist while new messages use a different selector.
If several services send for the domain, each can have its own selector. Do not replace a working selector for one service with another service's value. Add the current provider-issued record under its distinct name.
Use the Free Domain Mail DKIM workflow
Sign in to Free Domain Mail, open Manage, choose Domains and select the domain. Open Authenticate sending to view the DKIM records generated for the connected domain. Use the Copy controls rather than transcribing long values.
Publish each displayed record at the authoritative DNS provider, keep Cloudflare CNAME records DNS only, then run Check and complete. The freedomainmail.com domain is an example of how the hostname is formed; every connected domain receives its own values.
When DNS resolves but DKIM still fails
A public key can resolve while the signature fails because the message changed after signing, the wrong private key was used, the signature expired, canonicalization did not cover a modification safely, or an intermediary rewrote signed headers or body content.
Send directly through the intended provider and inspect Authentication-Results. Compare the selector used in the new message with DNS. If a forwarding or security gateway alters content, test without that hop before changing the key.
Retest without creating a reputation problem
After the public key and provider configuration match, send one normal test through the original path. Confirm DKIM=pass and verify that the d= domain aligns with the visible From domain when DKIM is expected to satisfy DMARC.
Do not repeat-send a large batch while the error persists. A successful DKIM check fixes authentication only; Gmail can still defer or reject mail for rate, reputation, content or recipient-policy reasons.
Common mistakes to avoid
- Looking up a guessed selector instead of the s= value used by the sender.
- Publishing the key at a non-authoritative DNS provider.
- Replacing another service's valid selector.
- Assuming a visible TXT or CNAME proves the message signature is valid.
- Ignoring a gateway that modifies the message after it is signed.
- Sending a large retry batch before one message passes.
Frequently asked questions
What does Gmail 550 5.7.30 mean?
Gmail blocked the message because DKIM authentication did not pass under its sender requirements.
Can SPF alone fix 5.7.30?
The diagnostic specifically identifies DKIM. Configure a valid DKIM signature for that sending path, even though SPF and DMARC should also be maintained.
Why does a DKIM checker pass while Gmail reports failure?
The checker proves a public record exists. Gmail verifies the signature on the actual message, which can fail because a different selector was used, the key does not match or signed content changed.
Should I delete old DKIM records?
Not until you know no active sender uses them. Distinct selectors can coexist safely and are often needed during key rotation.
Technical references
Primary specifications and provider documentation relevant to this guide: