MailFixIt

SMTP delivery response

SMTP 550 5.7.29: ARC validation failure

The receiver rejected the message because its Authenticated Received Chain did not validate.

Problem description

The registered response text is:

550 5.7.29 ARC validation failure
Is this temporary or permanent?

SMTP 550 is permanent for this delivery attempt. Sending the same message through the same path again is not a fix.

What failed

ARC records authentication results as a message passes through forwarding services, mailing lists, and gateways. Each handler can add one numbered ARC set. The receiver found that the chain’s signatures, order, or continuity were invalid.

Find the broken set

  1. Save the complete original message with all headers.
  2. Find every ARC-Seal, ARC-Message-Signature, and ARC-Authentication-Results header.
  3. Check that set numbers start at 1, increase without gaps, and contain one of each ARC header.
  4. Find the first set whose seal or message signature fails.
  5. Give the complete message to the administrator of the service that added that set.
  6. After correction, send a new message through the same forwarding path.

Common causes

An intermediary used the wrong ARC key, published a missing or stale selector, added an incomplete set, reused a set number, or changed signed content after sealing.

Do not change unrelated DNS

SPF, DKIM, and DMARC can affect the authentication results recorded inside ARC, but they do not repair a broken ARC signature or chain. Fix the service that created the first invalid set.

Frequently asked questions

What does SMTP 550 5.7.29 mean?

In the IANA registry and RFC 8617, 5.7.29 means ARC validation failure. It does not mean SPF failure, DKIM failure, or missing TLS.

Who should fix a broken ARC chain?

Usually the forwarding service, mailing list, security gateway, or other intermediary that added the first invalid ARC set.

Is Gmail 550 5.7.29 the same error?

No. Gmail documents its own 550 5.7.29 response for bulk mail sent without TLS. Use the Gmail-specific guide when that exact text appears.

Related email diagnostics

SMTP 5.7.1: Delivery not authorizedSMTP 5.7.1 means delivery is not authorized; use the full response to identify a recipient restriction, relay permission, transport rule, or filtering policy. Gmail 550 5.7.29: This message was blocked because it wasn't sent over a TLS connectionFix Gmail 550 5.7.29 by restoring TLS on the final SMTP connection to Gmail.

Primary sources: IANA SMTP Enhanced Status Codes, RFC 8617: The Authenticated Received Chain Protocol.