5.7.20No passing DKIM signature found

The receiving system permanently rejected the message because it contained no DKIM signature that passed verification. Do not retry the same unchanged attempt.

The standard X.7.20 pattern is returned when a message contains no passing DKIM signature; by definition, this violates the advice in Section 6.1 of RFC 6376. Code 5.7.20 applies this detail in the permanent-failure class.

The leading digit 5 denotes a permanent failure of the current attempt. The code alone does not distinguish between a missing DKIM signature and failure of every signature present, nor does it identify which layer caused that result.

Class

Permanent failure

Retry

Do not retry unchanged

Suppression

Check the full context

Operational guidance: stop automatic and manual retries of the same unchanged attempt because they will not change the DKIM result. Consider a new, controlled attempt only after a confirmed correction and verification that at least one DKIM signature passes; check suppression again first.

Operational guidance: do not automatically suppress the recipient address or domain based on 5.7.20 alone. Inspect the complete response, DKIM result, configuration of the systems involved, and event history, then make the suppression decision according to the confirmed cause and applicable policy.

• The message contained no DKIM signature at the point where it was evaluated.
• The message contained at least one DKIM signature, but none passed verification.

1. Inspect the raw SMTP response or nondelivery report and confirm the exact 5.7.20 code and a basic reply in the 5xx class; retain the complete response text.
2. Correlate the response with the intended message, attempt time and stage, and system that returned the code. In the message copy from the evaluation point, inspect DKIM-Signature headers and available verification results or logs to distinguish an absent signature from failure of every signature.
3. Inspect logs and configuration across the signing, transport, and verification path and establish the confirmed cause; do not assign it to the sender, recipient, or provider from the code alone.
4. Stop unchanged retries. After a confirmed correction, demonstrate that at least one DKIM signature passes verification, check suppression again, and make one controlled attempt.

Compare 2.7.0 and 4.7.0 for other or undefined security statuses in the success and temporary-failure classes, respectively, 4.7.1 for a temporary refusal of unauthorized delivery, and 4.7.12 for a required authentication-mechanism transition. None denotes a permanent rejection because no DKIM signature passed verification.

• 2.7.0Other or undefined security status (success)
• 4.7.0Other or undefined temporary security status
• 4.7.1Delivery not authorized, message temporarily refused
• 4.7.12Authentication mechanism transition required

The canonical Tier-0 meaning of X.7.20, its reference to the advice in Section 6.1 of RFC 6376, and its class-5 application were verified against the IANA registry and RFC 2034, RFC 5248, RFC 6376, and RFC 7372 as of July 17, 2026. Diagnostic, remediation, retry, and suppression recommendations are separate operational guidance; this record contains no provider-specific practice.

• iana-smtp-enhanced-status-codesT0 source

  Enumerated Status Codes / X.7.20

• rfc5248T0 source

  Section 2.1: registry fields and non-exclusive Associated Basic Status Code

• rfc2034T0 source

  Section 4: enhanced status class agrees with SMTP reply class

• rfc7372T0 source

  IANA registry reference for X.7.20

• rfc6376T0 source

  IANA registry reference for X.7.20

Last verified: 17 July 2026