Generic SMTP DKIM error

SMTP 5.7.21: no acceptable DKIM signature

Enhanced status code 5.7.21 means the receiver considered none of the available DKIM signatures acceptable. That is broader than a missing DNS record: key strength, identity, algorithm, signature validity, or receiver policy may matter.

Problem description

The delivery response may contain:

550 5.7.21 No acceptable DKIM signature found

Inspect the related DKIM selector

What MailFixIt can test: current public-key DNS for an exact selector and signing domain. It cannot decide whether a receiver should accept an algorithm or verify a signature without the original message.

Is this temporary or permanent?

This is a permanent result for the rejected attempt. Retry only after correcting a confirmed signing or key problem, or after the receiver clarifies its acceptance requirement.

Probable causes

The public key is missing, revoked, malformed, or does not match the signing key.
The signature uses an identity, algorithm, or key size the receiver does not accept.
The signed body or headers changed in transit.
Multiple signatures exist, but none validates under receiver policy.

Diagnostic sequence

Keep the original message source and bounce.
List every DKIM-Signature and its d=, s=, and a= values.
Inspect each exact selector owner in DNS.
Confirm the sender is using the private key paired with the published record.
Use the receiver's full text to identify any additional acceptance condition.

Resolution

Restore the exact provider-issued selector record or rotate the key through the sending provider. If DNS is valid, validate the original signature and check gateways that rewrite messages after signing. Never create a public key independently of the sender's private key.

Frequently asked questions

How is 5.7.21 different from 5.7.20?

5.7.20 says no signature passed; 5.7.21 says no signature was acceptable under the receiver's requirements. Actual provider wording remains authoritative.

Does publishing any DKIM key resolve 5.7.21?

No. The key must match the selector and private signing key, and the resulting signature must meet receiver requirements.

Can MailFixIt evaluate receiver acceptance policy?

No. It can inspect current selector DNS, while receiver policy and original-message signature verification remain outside the current check.

Related email diagnostics

Primary sources: IANA SMTP Enhanced Status Codes registry and RFC 6376 DKIM.