MailFixIt

Generic SMTP DKIM alignment error

SMTP 550 5.7.22: No valid author-matched DKIM signature found

550 5.7.22 means at least one DKIM signature passed, but none identified the author in the visible From header. This is not the same as a broken DKIM key.

Problem description

A receiver may report:

550 5.7.22 No valid author-matched DKIM signature found
Diagnostic availability: MailFixIt can inspect supplied headers and public keys, but it does not independently verify the original signature. Keep the complete headers for diagnosis.
Is this temporary or permanent?

The receiver permanently rejected this message. Correct the signing identity or message path, then send a new test.

What author-matched means

The passing signature must identify the author represented by the From header. A shared provider signature can pass cryptographic checks but still be unacceptable for your author address.

How to diagnose and fix it

  1. Keep the From and every DKIM-Signature header from the rejected message.
  2. Find which signatures passed and compare their identities with the From address.
  3. Enable custom-domain DKIM for the correct sending domain.
  4. Publish only the selectors supplied by that sender.
  5. Send a new test through the same service.

Frequently asked questions

What does SMTP 5.7.22 mean?

No valid DKIM signature matched the author domain required by the receiver.

Can DKIM pass but fail alignment?

Yes. A signature can validate for a domain that does not align with the visible From domain.

Does MailFixIt calculate message-level alignment?

No. It can inspect reported header results and current public keys, but it does not independently verify the original message signature and alignment.

Related email diagnostics

SMTP 550 5.7.20: No passing DKIM signature foundUnderstand SMTP 5.7.20, inspect the DKIM selector and public key, and fix a missing or failing DKIM signature without guessing DNS values. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key. DMARC policy for the visible From subdomain is unexpectedFind the effective DMARC policy for a visible From subdomain. See whether p, sp, np or test mode applies before changing DMARC DNS.

Primary sources: IANA SMTP Enhanced Status Codes registry, RFC 6376 DKIM, RFC 9989 DMARC.