Gmail sender authentication rejection

Fix Gmail 550 5.7.30 DKIM authentication failed

Gmail reports this when it cannot accept the message's DKIM authentication. Start with the exact selector and signing domain from the rejected message, then inspect the corresponding public DNS key before changing any sender configuration.

Problem description

Gmail rejects mail from your domain with the following error message:

Gmail rejected: 550 5.7.30 DKIM authentication failed.

Check the DKIM key free

Helpful evidence: paste only the headers from the rejected message. MailFixIt extracts the selector and signing domain; it does not return the raw header text.

What the check distinguishes

Missing key: the checked selector does not resolve to a public DKIM key.
Revoked key: an empty p= value intentionally disables the selector.
Invalid key: the published record is malformed or lacks a usable public-key value.
Key present: current DNS supplies a usable public key, which still does not verify the original signature.

Safe repair sequence

Open View Headers or View Source for the rejected message and identify s= and d= in DKIM-Signature.
Confirm that the sender is authorized to sign for that domain and selector.
Compare public DNS with the exact key or CNAME target supplied by the sending service.
Preserve unrelated selectors and records when replacing a key.
Send a fresh test message and review its receiving-server authentication results.

Current DNS alone cannot verify the rejected message's signature, historical DNS state, sender reputation or inbox placement. Reference: RFC 6376 DKIM.