What does a 550 error for invalid DKIM signature actually mean?

You sent an email. It bounced. The error says “550 Invalid DKIM signature.” You didn’t even change anything. Why is your domain suddenly being rejected?

That 550 error isn’t about your content or spam score. It’s a technical rejection at the server level—your email failed a cryptographic check that proves it came from your domain and hasn’t been tampered with in transit.

DKIM signing acts like a digital seal on your email. When correctly configured, it lets the receiving server verify that the message body and headers are exactly as your server sent them—and that the sender is authorized to use the domain. If the seal is broken, the server rejects the email outright.

Key takeaways

  • A 550 error for invalid DKIM means the receiving server failed to verify your email’s cryptographic signature
  • DKIM checks both the integrity of your email and the legitimacy of your sending domain
  • Failure usually indicates misconfiguration, outdated keys, or incorrect DNS records—not spam or poor content

Why is DKIM failing? 5 core causes of the 550 error

You’re seeing a 550 error for an invalid DKIM signature because your email’s cryptographic signature doesn’t match what the receiving server expects. This usually means a misconfigured or outdated DKIM record, a mismatch in domains, or a change in how your email service signs messages. Let’s go over the five most common reasons why this happens and how to fix them.

Check your DNS and signing setup

  • Verify that the DKIM public key is correctly published in your DNS records. If the record is missing or malformed, the receiving server cannot validate the signature—this is the most common cause of 550 errors.
  • Ensure the selector and domain name in your DKIM TXT record exactly match the signing configuration. A single typo in the selector (like using default instead of dkim) breaks verification.
  • Confirm that the signing domain matches the domain in the From: header. If you’re sending from [email protected] but signing with campaigns.acme.com, the match fails.

Watch for changes and key rotation

  • Check if your email service provider recently changed how emails are signed—sometimes providers update their keys or signing domains without notice. If you haven’t updated your DNS in response, the signature will fail.
  • DKIM keys can expire or be revoked, especially if your provider uses automated rotation. An expired key won’t verify, leading to a 550 error. This is common with cloud-based email services that rotate keys every few months.
  • Use tools like MXToolbox or RFC 6376 to validate your DKIM settings in real time. These standards define how DKIM signatures are constructed and verified.

Fixing DKIM issues isn’t just about preventing bounces—it ensures your emails land in inboxes, not junk folders. Misconfigured DKIM is a frequent cause of deliverability drops, especially with larger organizations relying on complex email routing.

Want to catch these problems before they hit your sender reputation? Run a full inbox placement test using our inbox placement tool to see how your authenticated emails perform in real-world inboxes across different providers.

How to verify your DKIM configuration is correct

When you receive a 550 error for an invalid DKIM signature, it usually means your email’s DKIM record doesn’t match what receiving servers expect. To fix it, you must confirm your DKIM TXT record is properly published, uses the correct selector, contains the right public key, and is published at the right domain level. Use a trusted DNS lookup tool to check these elements directly.

Verify the DKIM record with a DNS tool

  1. Go to a DNS check service like MxToolbox or use your email provider’s built-in DNS checker. Enter your domain (e.g., yourcompany.com) and search for the DKIM TXT record.
  2. Look for the full record, which typically starts with a selector like default._domainkey. This selector must match the one your email service (like SendGrid, Amazon SES, or Microsoft 365) uses to sign outbound emails.
  3. Check that the public_key string inside the TXT record exactly matches the one generated by your sending platform. Even one character difference—like a missing space or incorrect uppercase form—breaks verification.
  4. Verify the record is published at the root domain level (e.g., default._domainkey.yourcompany.com), not under a subdomain like mail.default._domainkey.yourcompany.com. A mispositioned record is a common cause of 550 errors.
  5. Wait 24–48 hours after making DNS changes. DNS propagation varies by network. Use tools like DNSChecker.org to confirm the record is live across multiple global servers.
  6. If all checks pass, your DKIM configuration is correct. If not, double-check the selector, the key format, and the domain location.

Why DKIM fails even when configured

Even with a correct TXT record, delivery can still fail. Common reasons include expired keys, misconfigured selectors in email clients, or using multiple DKIM keys without proper alignment. RFC 6376 (the DKIM specification) defines how signatures are validated, and receiving servers strictly enforce it.

Use bulk email verification to validate the full list of recipients before sending. It detects common deliverability issues early, including those tied to authentication failures, helping you avoid 550 errors before they reach the inbox.

Common DKIM configuration mistakes in practice

You’re getting a 550 error for an invalid DKIM signature because your email’s DKIM record is misconfigured—common issues include conflicting records, wrong signing domains, incorrect placement, missing format tags, or stale keys. These missteps break authentication and trigger rejection from receiving servers. Let’s look at how these mistakes show up in real-world setups.

Conflicting or duplicate DKIM records

It's tempting to add a new DKIM record when switching providers, but publishing two DKIM records for the same selector (like "default") creates conflict. Receiving servers see this as a sign of inconsistency and reject the email. This is explicitly discouraged in RFC 6376, which outlines the standard for DKIM.

For example, if you have one record signed with a key from your old ESP and another from your new one, both with selector "default", the receiving server has no way to validate which signature is legitimate. Always verify DNS records with tools like MXToolbox before going live.

Domain mismatch in From: header vs signing domain

DKIM signs the email using the domain you configured in DNS. If your From: header uses a different domain—like [email protected] while DKIM signs on newsletter.company.com—the verification fails. The receiving server checks alignment between the From domain and the DKIM signature's domain, and a mismatch triggers a 550 error.

You can find these issues by testing your outbound emails with an inbox placement tool. Some tools, like the inbox placement test on EmailListChecker, include DKIM validation as part of their deliverability assessment.

DKIM record placement and format

DKIM records must be published at the root domain, not under a subdomain. Placing a DKIM record only under default._domainkey.mail.company.com instead of default._domainkey.company.com causes the signature to fail verification.

Also, forgetting the v=DKIM1; tag at the start of the record means the DNS server won't recognize it as a valid DKIM record. This is a fundamental syntax requirement. Tools that validate DNS entries, like bulk verification on EmailListChecker, can catch this mistake early.

Static keys and poor key rotation

Using the same private key across multiple senders or not rotating keys regularly increases the risk of compromise. If one sender’s key is exposed, attackers can forge signed emails from other senders on the same domain. Best practice, per industry guidance from organizations like the IETF, includes periodic key rotation.

Making your DKIM key rotation part of your infrastructure process is a small step with a big impact on long-term sender reputation and deliverability.

Why SPF and DMARC don’t fix DKIM failures

If your outbound emails are failing with a 550 error due to an invalid DKIM signature, the issue isn’t just SPF or DMARC—it’s that DKIM is the primary validation layer for email authenticity. SPF checks the sending IP, and DMARC uses SPF and DKIM results to decide what to do with your message. But if DKIM fails, DMARC will also fail, even if SPF passes. You can't skip DKIM by relying on SPF alone; the 550 error appears because the receiving server requires a valid DKIM signature.

How SPF, DKIM, and DMARC interact

SPF validates whether the sending IP is authorized to send on behalf of the domain. DKIM adds a cryptographic signature to the email headers and body, proving the message hasn’t been altered. DMARC combines both and defines policies—like quarantine or reject—if either SPF or DKIM passes. However, DMARC doesn’t require SPF to pass; it only needs one valid method: SPF or DKIM.

But here's the catch: if DKIM fails, and SPF passes, DMARC may still pass, depending on policy. Yet in outbound email delivery, a failed DKIM signature often triggers an immediate 550 error from servers like Gmail, Outlook, or corporate gateways. That’s not the DMARC policy—it’s the server’s hard rule about signature integrity. You can’t bypass this with SPF alone.

Why SPF doesn't override DKIM failures

Think of it like a two-lock system. SPF is one lock, DKIM is the other. Even if SPF works, a failed DKIM means the message fails the cryptographic authentication. This triggers a 550 error in many systems because they reject emails without a valid DKIM signature, regardless of SPF.

Some providers, like Google's sending infrastructure, explicitly reject emails with invalid DKIM signatures—even if SPF is valid. The DMARC specification (RFC 7284) states that DMARC's policy decisions are based on either SPF or DKIM alignment, but that doesn’t mean failed DKIM won’t trigger delivery failures. The receiving server may use multiple layers of validation and drop messages where DKIM is invalid.

Let's clear one thing: SPF and DMARC don’t "fix" DKIM failures. They just help enforce what should be valid. If DKIM is broken, the signature is missing, invalid, or mismatched—fix the key, not the lock.

If you're seeing 550 errors for invalid DKIM signatures, the root cause is likely misconfigured keys, incorrect signing settings, or a broken signing process in your email platform. Use tools like inbox placement testing to verify how your messages are being interpreted by real email providers—even before you send to real users.

How DNS propagation delays can trigger false 550 errors

Even after you update your DKIM record in DNS, it can take up to 72 hours for the change to propagate across the global network. During this window, some receiving servers still see the old or missing record, which triggers a 550 error claiming your DKIM signature is invalid—even though your configuration is correct. If you just updated your key, wait 48–72 hours before troubleshooting further.

The DNS update lifecycle

When you publish a new DKIM public key, the change doesn’t go live instantly. DNS resolvers around the world cache records for a fixed time (defined by the Time-To-Live or TTL value), often between 24 and 72 hours. Until those caches refresh, some mail servers will query for the old key—or find it missing entirely—leading to a 550 bounce.

Let’s say you rotated your DKIM key yesterday. Your outbound emails might start failing with “Invalid DKIM signature” when the receiving server checks the DNS record. But the record you published is correct—it’s just not visible everywhere yet. This isn’t a fault in your setup. It’s the timing delay inherent in how DNS distributes data.

Think of DNS propagation like sending a letter to a million addresses at once. Not every post office updates its directory the same day. Some still route to the old address, even after the change has been made. The same happens with mail servers checking DKIM alignment—it’s not a broken key, just inconsistent data.

How to verify it’s actually propagating

Check the DNS record from multiple locations using tools like MXToolbox or DNSStuff. Run checks from different geographic regions. If the new DKIM record appears in one location but not another, you’re seeing propagation in progress. Once all major resolvers return the updated record, the 550 errors should stop.

Many tools also track DNS TTLs and provide real-time propagation updates. If your DNS provider offers a propagation monitoring tool, use it. You’re waiting for convergence, not configuration changes.

If the error persists after 72 hours, then you can safely assume the setup is broken. But if the issue vanishes within that window, it was always a timing delay. The key is not to react immediately—waiting 48 hours gives you time to gather proof before assuming it's your fault.

How to test your DKIM signature before sending to real recipients

You get a 550 error for invalid DKIM signature because your email’s cryptographic signature isn’t aligning with the domain’s DNS records during transit. The fix isn’t guessing—test your DKIM in real time across multiple email providers before sending to real users. This prevents bounces, blocks, and reputation damage.

  1. Run your email through a real-time deliverability tester like inbox placement testing to simulate how your outbound messages perform in live inboxes. These tools send test emails through major providers (Gmail, Outlook, Yahoo) and validate DKIM, SPF, and DMARC in real time.
  2. Verify DKIM signature alignment across multiple receivers—not just one. A single pass in Gmail doesn’t guarantee validity everywhere. Use a tool that checks signatures at multiple provider endpoints, including those with strict filtering policies.
  3. Monitor for failed checks in third-party testing environments. Some email providers, like Gmail and Microsoft, will reject or quarantine messages with invalid or missing DKIM signatures. If your test fails on one or more platforms, it means your public key isn’t correctly published or your signing algorithm doesn’t match the selector.
  4. Check your DNS configuration for errors. DKIM relies on a TXT record published at a specific selector subdomain (e.g., default._domainkey.example.com). Mistyped or malformed records cause validation failures. Use an official tool like MXToolbox to verify the full record is correct and publicly visible.
  5. Validate the signing process. Ensure your email server or ESP is applying DKIM correctly—using the right algorithm (SHA-256 is standard), signing the correct headers, and including the h= tag with expected fields. Misconfigured signing leads to silent failures.

Why testing before sending matters

Once you send an email with a broken DKIM signature, you risk hitting spam filters, damaging sender reputation, and getting blacklisted. The damage is reversible but costly. Testing in real environments catches issues early, before they impact real users.

Use tools built for real-world conditions

Instead of relying on offline analyzers or generic tools, use a service that mimics actual inbound paths. EmailListChecker’s inbox placement tests include DKIM validation across major platforms. It’s not just about checking syntax—it’s about seeing how your message lands in real inboxes.

For developers, integrating with the real-time verification API allows you to validate DKIM and other headers automatically during outbound campaigns. This scales with your list size and ensures every message meets basic deliverability standards before leaving your server.

Preventing future DKIM signing issues with list hygiene

DKIM errors like 550 often stem from sending to invalid or risky addresses that hurt your sender reputation. Clean your lists regularly to avoid these issues — removing invalid, role-based, or reputational risk addresses before they trigger deliverability problems. Real-time validation and bulk verification are essential to catch misconfigurations early and maintain consistent DKIM signing behavior.

Build a reliable send base with proactive list hygiene

  • Run your email list through bulk verification tools like bulk email verification every 30–60 days to remove invalid or role accounts that could break DKIM due to bounce patterns or reputation spikes.
  • Flag and remove addresses tied to known spam traps or domains with poor deliverability history — these can indirectly affect your sender rating even if you’re compliant.
  • Check for catch-all or wildcard configurations on domains. These can cause false positives in delivery logs and trigger 550 bounces during DKIM validation.

Integrate real-time validation to stop issues before they start

  • Use Emaillistchecker.io’s real-time verification API to validate every address in your send stream before it’s sent out — this catches invalid or high-risk entries before they trigger DKIM failures.
  • Add verification to your onboarding pipeline so new leads are filtered instantly, reducing the chance of sending to malformed or disposable domains.
  • Monitor for address patterns that suggest misuse, like admin@, support@, or abuse@ — these are often role accounts with poor engagement, leading to poor sender reputation if included.
Improper list hygiene is a leading cause of sender reputation decay. Even a single bounce from an invalid address can degrade your delivery rate over time. Address quality impacts everything from DKIM to spam scoring.

DKIM signing isn’t broken — your list might be. Maintaining a clean, high-quality contact base reduces the risk of deliverability events that corrupt your sending reputation. Tools like Emaillistchecker.io help spot issues early, so you don’t spend time debugging signatures when the real issue is a bad address. Clean lists enable cleaner DKIM, better inbox placement, and predictable delivery. Test your inbox placement alongside list cleaning to validate results.

If your outbound emails trigger a 550 error due to an invalid DKIM signature, the root cause may not be your DKIM setup—it could be that you’re sending to corrupted, forged, or malformed addresses. These bad addresses can trigger spam filters, degrade sender reputation, and cause DKIM checks to fail even if your signing is technically sound. Use Emaillistchecker.io to validate your list before sending, catch risky addresses early, and ensure only valid, deliverable emails are sent.

Step-by-step: Identify and fix DKIM risk factors in your email list

  1. Run your outbound list through Emaillistchecker.io’s bulk verification to flag high-risk addresses such as typosquatted domains, role accounts, disposable emails, and catch-all inboxes. These can appear legitimate but often cause delivery failures or trigger anti-spoofing checks. Catching them early prevents them from tainting your sender reputation.
  2. Check the deliverability score and bounce rate forecast before sending. A list with high bounce risk—especially from addresses that don’t exist or are intentionally misconfigured—can lead to temporary or permanent blocklists. Poor list hygiene directly impacts your sending reputation. Providers like Gmail and Outlook use aggregate reputation signals; a cluster of bounces from a single IP can cause DKIM validation to fail even when the signature is correct.
  3. Use the inbox-placement test to simulate real-world delivery across major email providers. This test checks not just DKIM validity but also how your message performs in actual inboxes. If an email fails to land in the inbox, it might be flagged due to a mix of sender reputation, content signal, or an invalid DKIM signature tied to a bad address. Testing early reveals issues before they cost you deliverability.

Why it works: How list health affects DKIM

DKIM signs the email content at the time of sending, but if the envelope sender or recipient is invalid—or if the email is routed through a compromised or poorly maintained domain—anti-spoofing systems may reject the signature. This isn’t a flaw in DKIM itself, but in the underlying infrastructure. The DKIM RFC explicitly states that a valid signer does not guarantee deliverability; it only confirms integrity. If the recipient’s domain is misconfigured or if your list includes forged addresses, the signature may be valid but still rejected.

Using Emaillistchecker.io gives you visibility into those hidden risks. You’re not just verifying syntax; you’re testing the real-world deliverability of the entire list. Tools like MXToolbox can check domain records, but they can’t analyze the hygiene of a list at scale. Emaillistchecker.io does—offering a clear path to reduce bounces and strengthen your sender reputation, which in turn supports consistent DKIM success.

Start with bulk verification to clean your list before sending, and always run test campaigns via inbox placement to catch issues early.

Summary: diagnose, validate, and verify before sending

A 550 error for an invalid DKIM signature indicates a configuration issue on your side, not a problem with the recipient. It’s a technical sender error, commonly caused by misaligned keys, incorrect DNS records, or mismatched signing domains.

Key steps to resolve

  • Confirm your DKIM public key is correctly published in DNS.
  • Ensure the selector, domain, and key values match what your email provider uses.
  • Validate header alignment: the From domain must match the signing domain.
  • Allow time for DNS propagation after changes—up to 48 hours in some cases.

DNS and cryptographic settings are not forgiving. A single mismatch breaks authentication. The only way to be sure is to test, verify, and validate.

Sources

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can a bad email list cause a DKIM signature failure?

Not directly, but a poor-quality list with high bounce rates or spoofed addresses can harm sender reputation, which may influence how strictly DKIM is enforced during delivery attempts.

Does DKIM need to be set up for every domain I send from?

Yes, each sending domain must include a valid DKIM record in DNS; using a single key across multiple domains can result in misalignment and signature failures.

Can I fix a 550 error by asking the recipient to change their filter?

No. The 550 error is server-side and not within the recipient’s control. The fix lies in correcting your domain’s DKIM record.

How do I know if my DKIM key is expired?

Check your email service provider’s key management dashboard. If key rotation is automated, ensure it’s not failing or producing invalid records.

Is DKIM required for email delivery?

Not strictly required, but most modern email providers use DKIM as part of their spam filtering and reputation scoring. A failed DKIM signature increases inbox placement risk.

Can I use one DKIM key for all senders on my domain?

Yes, but only if all senders use the same domain and the same signing infrastructure. Mismatched headers or domains will still cause failures.

What’s the difference between DKIM and SPF?

SPF validates the sending IP address; DKIM validates the content of the message and its origin. Both are used by DMARC but serve different roles in email authentication.

Why does my email fail DKIM only when sent through some providers?

Different providers use different authentication policies. Some may be stricter on DKIM alignment, especially if the signing domain doesn’t match the From: domain.

How often should I rotate DKIM keys?

Most providers recommend rotation every 90–180 days. Always ensure new keys are published in DNS before deactivating old ones.

Can a typo in an email address cause a DKIM failure?

No, a typo in the address doesn’t impact DKIM signature validity. But it can trigger bounces or delivery failure that may affect your overall sender reputation.

Does Emaillistchecker.io test DKIM directly?

It doesn’t validate your DNS records directly, but it tests your email’s deliverability and inbox placement, which includes how DKIM is handled by real providers.

Can I test DKIM using free tools?

Yes, tools like MxToolbox offer free DKIM record lookup, but they don’t replicate real delivery performance like inbox placement tests do.