Gmail sender authentication rejection

Gmail 550 5.7.30: This message was blocked because it didn't pass DKIM authentication

Gmail reports this when it cannot accept the message's DKIM authentication. Start with the exact selector and signing domain from the rejected message, then inspect the corresponding public DNS key before changing any sender configuration.

Problem description

Gmail rejects mail from your domain with the following error message:

550 5.7.30 This message was blocked because it didn't pass DKIM authentication. Authentication results: DKIM = did not pass.

Run this automated test on my domain

Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.

Is this temporary or permanent?

550 is permanent for this delivery attempt. Correct the signing or public-key path before sending a fresh message through the same service.

Helpful evidence: paste only the headers from the rejected message. MailFixIt extracts the selector and signing domain; it does not return the raw header text.

What the check distinguishes

Missing key: the checked selector does not resolve to a public DKIM key.
Revoked key: an empty p= value intentionally disables the selector.
Invalid key: the published record is malformed or lacks a usable public-key value.
Key present: current DNS supplies a usable public key, which still does not verify the original signature.

Safe repair sequence

Open View Headers or View Source and identify s= and d= in DKIM-Signature.
Confirm that the sender is authorized to sign for that domain and selector.
Compare public DNS with the exact key or CNAME target supplied by the sending service.
Preserve unrelated selectors and records when replacing a key.
Send a fresh test message and review its receiving-server authentication results.

Current DNS alone cannot verify the rejected message’s signature, historical DNS state, sender reputation or inbox placement.

Frequently asked questions

What does Gmail 550 5.7.30 mean?

It is a Gmail receiver-reported DKIM authentication failure. Use the selector and signing domain from the failed message to inspect the matching public key.

Where do I find a DKIM selector?

Open View Headers or View Source. DKIM-Signature contains s= for the selector and d= for the signing domain.

Does a published DKIM key prove Gmail will accept the message?

No. It confirms current DNS only; verification also depends on the signed message and receiver processing.

Related email diagnostics

DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key. Microsoft 365 DKIM: CNAME record does not exist for this configCheck a Microsoft 365 DKIM CNAME record against the exact values issued for your tenant. Safely diagnose missing or mismatched selector1 and selector2 DNS records.

Run this automated test on my domain

Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.

Primary sources: Gmail SMTP errors, RFC 6376 DKIM.