Generic SMTP DKIM error

SMTP 5.7.20: no passing DKIM signature found

Enhanced status code 5.7.20 means the receiver found no DKIM signature that passed. Determine whether the message was unsigned, the selector key was unavailable, or the signed content changed in transit before editing DNS.

Problem description

A receiving server returns a response similar to:

550 5.7.20 No passing DKIM signature found

Check the related DKIM public key

What MailFixIt can test: the current DNS key at a supplied selector and signing domain, including missing, malformed, revoked, or unsupported keys. It cannot cryptographically verify the rejected message.

Is this temporary or permanent?

The 5.x.x result is permanent for that delivery attempt. Publish or correct a confirmed key, enable signing if it was absent, then send a new message.

Why DKIM did not pass

The service did not add a DKIM-Signature.
The s= selector or d= signing domain points to a missing or invalid key.
A CNAME target or delegated key record is wrong.
A gateway modified signed headers or body content after signing.
The signature algorithm, key, or canonicalization was unacceptable to the receiver.

How to diagnose SMTP 5.7.20

Preserve the original headers and full rejection.
Read d= and s= from DKIM-Signature; do not infer a selector.
Query selector._domainkey.signing-domain and follow an exact CNAME if present.
Validate key syntax and compare it with the sender's issued value.
Send a new message and inspect Authentication-Results after the change.

How to fix it

If no signature exists, enable DKIM in the actual sending service. If the DNS key is absent or invalid, publish the exact provider-issued record at the exact owner. If DNS is correct but verification still fails, inspect the original message for post-signing modification or rotate the provider-managed key. A valid public key alone does not prove that outbound signing is active.

Frequently asked questions

What does SMTP 5.7.20 mean?

The receiver found no DKIM signature that passed validation. The code does not by itself identify whether signing, DNS, or message modification caused the failure.

Can a DNS check prove that DKIM passed?

No. It can inspect the public key for a known selector, but cryptographic verification requires the original signed message.

Which DKIM selector should I check?

Use the selector in the message's DKIM-Signature header or the exact selector supplied by the sending provider.

Related email diagnostics

Primary sources: IANA SMTP Enhanced Status Codes registry and RFC 6376 DKIM.