Make 550 5.7.1 go away: SPF, DKIM and DMARC in 20 minutes

A 550 5.7.1 bounce means the receiving server refused your message on policy grounds. When the text mentions authentication, the fix is in DNS, not in your code.

550 5.7.1ErrorUnauthenticated email rejectedThe receiving server rejected the message because it failed SPF/DKIM alignment and the From domain's DMARC policy is p=reject. Sign with DKIM for the From domain and include your sender in SPF.

SPF: who may send

DNS

example.com.  TXT  "v=spf1 include:_spf.your-esp.com -all"

DKIM: proof the message wasn’t changed

Your email provider generates the key pair; you publish the public half at the selector they give you.

DNS

s1._domainkey.example.com.  CNAME  s1.domainkey.your-esp.com.

DMARC: what to do when both fail

DNS

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Tip

Start at p=none and read the aggregate reports for two weeks before moving to quarantine. Forgotten senders (the CRM, the billing tool) show up there first.

Watch out

550 5.1.1 is different: the mailbox does not exist. Remove the address; retrying hurts your sender reputation.

550 5.1.1ErrorRecipient address rejected: user unknownThe mailbox does not exist at the destination domain — a hard bounce. Stop sending to that address and add it to your suppression list; retrying hurts sender reputation.