TL;DR
Permanent authentication-policy rejection: no DKIM signature passed verification. Fix signing on the sending path before retrying. Missing or failing DKIM hurts domain reputation and inbox deliverability. Do not retry unchanged.
What this code means
No DKIM signature on the message passes cryptographic verification at evaluation time; that condition is registry pattern X.7.20, returned as code 5.7.20. The first digit places the outcome in class 5 permanent failures under the enhanced status register. This security-family detail signals missing or failing DKIM coverage relative to RFC 6376 Section 6.1 advice. The code alone does not distinguish absent DKIM-Signature headers from signatures that were present but invalid, nor does it identify which layer on the signing or verification path caused the result.
Technical meaning
Absence of any passing DKIM signature is the X.7.20 condition; by definition that outcome violates the advice in Section 6.1 of RFC 6376. Code 5.7.20 applies this detail in the permanent-failure class.
Delivery status
The leading digit 5 denotes a permanent failure of the current attempt. The code alone does not distinguish between a missing DKIM signature and failure of every signature present, nor does it identify which layer caused that result.
- Class
- Permanent failure
- Retry
- Do not retry unchanged
- Suppression
- Check the full context
Retry decision
Operational guidance: stop automatic and manual retries of the same unchanged attempt because they will not change the DKIM result. Consider a new, controlled attempt only after a confirmed correction and verification that at least one DKIM signature passes; check suppression again first.
Suppression decision
Operational guidance: do not automatically suppress the recipient address or domain based on 5.7.20 alone. Inspect the complete response, DKIM result, configuration of the systems involved, and event history, then make the suppression decision according to the confirmed cause and applicable policy.
Common causes
- The message contained no DKIM signature at the point where it was evaluated.
- The message contained at least one DKIM signature, but none passed verification.
Diagnostic steps
- Inspect the raw SMTP response or nondelivery report and confirm the exact 5.7.20 code and a basic reply in the 5xx class; retain the complete response text.
- Correlate the response with the intended message, attempt time and stage, and system that returned the code. In the message copy from the evaluation point, inspect DKIM-Signature headers and available verification results or logs to distinguish an absent signature from failure of every signature.
- Inspect logs and configuration across the signing, transport, and verification path and establish the confirmed cause; do not assign it to the sender, recipient, or provider from the code alone.
- Stop unchanged retries. After a confirmed correction, demonstrate that at least one DKIM signature passes verification, check suppression again, and make one controlled attempt.
Actions by owner
Sender
- Do not repeatedly send the same unchanged message; give the administrator the complete response and attempt time without exposing message content or secrets.
Sender administrator
- Inspect the sent-message copy and signing and transport logs and configuration; establish whether the signature was absent or every signature present failed verification, then correct only the confirmed cause.
- After the correction, confirm that at least one DKIM signature passes, check suppression again, and make one controlled attempt instead of retrying the unchanged message.
Recipient administrator
- If you manage the system that returned the code, inspect its DKIM verification logs and configuration for the specified attempt; correct a confirmed receiving-side problem or safely give the sender the result needed for remediation.
Provider
- If you operate a managed signing, transport, or verification layer, inspect its logs and configuration for the attempt, correct a confirmed problem in that layer, and do not trigger suppression from the code alone.
Sources
These sources define what this enhanced status code means, mainly through the IANA registry and related RFCs. When provider examples appear on the page, they come from that provider's published documentation. Follow the links to read the original wording in context.
- SMTP Enhanced Status Codes — IANA registry of enhanced mail system status codes.
- RFC 5248 — A Registry for SMTP Enhanced Mail System Status Codes — Creates and governs the IANA enhanced status code registry.
- RFC 2034 — SMTP Service Extension for Returning Enhanced Error Codes — Defines how SMTP returns enhanced status codes to clients.
- RFC 7372 — Email Authentication Status Codes — Status codes for SPF, DKIM, DMARC and related authentication results.
- RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures — DKIM signature standard for authenticating email domains.
Last verified:
