SMTP Error 550 5.7.1: Unauthenticated email rejected

Identify: does your log match?

550-5.7.1 Unauthenticated email from example.com is not accepted due to
550-5.7.1 domain's DMARC policy. Please contact the administrator of
550-5.7.1 example.com domain if this was a legitimate mail. To learn about
550-5.7.1 the DMARC initiative, go to
550 5.7.1  https://support.google.com/mail/?p=DmarcRejection d9443c01a7336-20e2b4c1a2fsi1234567b3.512 - gsmtp

1. High

   Sending service missing from SPF

   Mail goes out through a provider (SES, SendGrid, Resend) whose IPs are not in the domain's SPF record, so SPF fails.

2. High

   DKIM signs with a different domain

   The provider signs with its own domain (d=amazonses.com), which does not align with the From domain, so DMARC fails even if DKIM passes.

3. Low

   Forwarding breaks SPF

   A forwarder relays the message from its own IP; without ARC or aligned DKIM the final hop fails DMARC.

Fix

example.com.  TXT  "v=spf1 mx -all"
_dmarc.example.com.  TXT  "v=DMARC1; p=reject"

dig +short TXT example.com
dig +short TXT resend._domainkey.example.com
dig +short TXT _dmarc.example.com

# records to publish
example.com.         TXT  "v=spf1 mx include:amazonses.com -all"
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

Verify: reproduce it on purpose

$ swaks --to you@gmail.com --from test@yourdomain.com --server gmail-smtp-in.l.google.com --port 25

Prevent

• Use a custom MAIL FROM / return-path subdomain at your ESP.
• Monitor DMARC aggregate (rua) reports weekly.
• Send marketing and transactional mail from separate subdomains.