What 550 5.7.30 means
Gmail returns 550 5.7.30 when a message 'didn't pass DKIM authentication' and the sender is subject to Gmail's bulk sender requirements, which include DKIM. 421 4.7.30 is the temporary version, where Gmail rate limits instead of blocking.
IANA registers 5.7.30 as 'REQUIRETLS support required', an unrelated meaning; Gmail uses the code for its DKIM requirement, and the bounce text makes that clear.
What the bounce looks like
The wording providers document for this code. Your bounce may add an IP address, a session ID or a help link after it.
550 5.7.30 This message was blocked because it didn't pass DKIM authentication. Gmail requires bulk email senders to authenticate their email with DKIM. Authentication results: DKIM = did not pass421 4.7.30 Your email has been rate limited because DKIM authentication didn't pass for this message. Gmail requires all email bulk senders to authenticate their email with DKIM.Temporary version. Same fix.
Why cold emailers see 550 5.7.30
- DKIM isn't enabled for your domain at your sending provider.
- The DKIM public key in DNS doesn't match the private key signing the mail (rotated key, wrong selector, truncated TXT record).
- Something modified the message after signing: a footer added by a relay, a link-tracking rewrite, or a line-ending change.
How to fix 550 5.7.30
- Look up the selector from a sent message's DKIM-Signature header (the s= value) and check that TXT record exists at selector._domainkey.yourdomain.com.
- Regenerate and republish the key if it's missing or truncated. Long 2048-bit keys sometimes need splitting into multiple strings.
- Make sure nothing alters the message after it's signed.
- Confirm 'dkim=pass' with your own domain in Gmail's Show original before resending.
Retry or suppress?
Don't suppress the recipient. Fix DKIM and resend.
Reading the code
The basic code 550 means "Mailbox unavailable or message refused (permanent)" under RFC 5321. In 5.7.30, the 5 is the class (permanent failure) and the 7 is the subject (security or policy). The detail number 30 is registered in RFC 3463 / the IANA registry as "REQUIRETLS support required".
- Class 5
- Permanent failure
- Resending the same message won't work. Something about the message, the recipient or the sender has to change first.
- Subject 7
- Security or policy
- A security or policy decision: spam filtering, authentication, blocklists, permissions.
- Detail 5.7.30
- REQUIRETLS support required
Check the rest of your setup
Run your sending domain through the SPF, DKIM & DMARC checker to see which record fails, then follow how to set up SPF, DKIM and DMARC. Paste the headers of a test message into the email header analyzer to confirm all three pass.
Got a different bounce? Paste it into the SMTP error code lookup to decode it.