What 554 5.7.9 means
Yahoo returns 554 5.7.9 'Message not accepted for policy reasons' when a message breaks one of its filtering, authentication or anti-abuse rules. Yahoo's own help article ties it to DMARC: the From domain publishes p=reject and the message didn't pass, often because it was forwarded.
Yahoo's sender guidance says permanent 5xx errors should not be retried. Fix the cause, then send a new message.
What the bounce looks like
The wording providers document for this code. Your bounce may add an IP address, a session ID or a help link after it.
554 5.7.9 Message not accepted for policy reasons. Why cold emailers see 554 5.7.9
- DMARC failure on a domain with p=reject: SPF and DKIM didn't align with the From domain.
- Mail forwarded through another server that broke SPF, without a valid DKIM signature to fall back on.
- Poor sender reputation or content that matches Yahoo's spam rules.
How to fix 554 5.7.9
- Confirm SPF, DKIM and DMARC all pass with alignment for your From domain.
- Make sure DKIM signs with your own domain, so DMARC survives forwarding.
- Since February 2024 Yahoo requires bulk senders to authenticate with SPF and DKIM and publish DMARC, so fix those first.
- If authentication passes, look at reputation: complaint rate, list quality and volume.
Retry or suppress?
Don't suppress the recipient over a policy rejection; fix authentication and resend. Don't retry the same message unchanged.
Reading the code
The basic code 554 means "Transaction failed (permanent)" under RFC 5321. In 5.7.9, the 5 is the class (permanent failure) and the 7 is the subject (security or policy). The detail number 9 is registered in RFC 3463 / the IANA registry as "Authentication mechanism is too weak".
- Class 5
- Permanent failure
- Resending the same message won't work. Something about the message, the recipient or the sender has to change first.
- Subject 7
- Security or policy
- A security or policy decision: spam filtering, authentication, blocklists, permissions.
- Detail 5.7.9
- Authentication mechanism is too weak
Check the rest of your setup
Run your sending domain through the SPF, DKIM & DMARC checker to see which record fails, then follow how to set up SPF, DKIM and DMARC. Paste the headers of a test message into the email header analyzer to confirm all three pass.
Got a different bounce? Paste it into the SMTP error code lookup to decode it.