5.7.21No acceptable DKIM signature found

The receiving system permanently rejected the message: at least one DKIM signature passed verification, but none was considered acceptable. Do not retry the attempt unchanged.

The standard X.7.21 pattern is returned when a message contains one or more DKIM signatures that pass verification, but none of those signatures is acceptable. By definition, this violates the advice in Section 6.1 of RFC 6376. Code 5.7.21 applies this detail in the permanent-failure class.

The leading digit 5 denotes a permanent failure of the current attempt. The code confirms that at least one DKIM signature passed verification, but it does not explain why none was accepted or identify which party is responsible for the result.

Class

Permanent failure

Retry

Do not retry unchanged

Suppression

Check the full context

Operational guidance: stop automatic and manual retries of the same unchanged attempt. Consider a new, controlled attempt only after establishing the cause and making a confirmed change that allows at least one passing signature to be accepted; check suppression again first.

Operational guidance: do not automatically suppress the recipient address or domain based on 5.7.21 alone. Inspect the complete response, DKIM results, configuration of the systems involved, and event history, then make the suppression decision according to the confirmed cause and applicable policy.

• The direct reason for rejection was that at least one DKIM signature passed verification, but the receiving system did not consider any passing signature acceptable.

1. Inspect the raw SMTP response or nondelivery report and confirm the exact 5.7.21 code and a basic reply in the 5xx class; retain the complete response text.
2. Correlate the response with the intended message, attempt time and stage, and system that returned the code. In the message copy from the evaluation point, inspect DKIM-Signature headers and available verification results to confirm that at least one signature passed.
3. Inspect logs and configuration across signing, transport, and the receiving DKIM evaluation to establish why no passing signature was accepted; do not assign responsibility from the code alone.
4. Stop unchanged retries. After a confirmed correction, verify that at least one passing signature is accepted, check suppression again, and make one controlled attempt.

Compare 2.7.0 and 4.7.0 for other or undefined security statuses in the success and temporary-failure classes, respectively, 4.7.1 for a temporary refusal of unauthorized delivery, and 4.7.12 for a required authentication-mechanism transition. None denotes a permanent rejection in which a DKIM signature passed verification but was not accepted.

• 2.7.0Other or undefined security status (success)
• 4.7.0Other or undefined temporary security status
• 4.7.1Delivery not authorized, message temporarily refused
• 4.7.12Authentication mechanism transition required

The canonical Tier-0 meaning of X.7.21, its reference to the advice in Section 6.1 of RFC 6376, and its class-5 application were verified against the IANA registry and RFC 2034, RFC 5248, RFC 6376, and RFC 7372 as of July 17, 2026. Diagnostic, remediation, retry, and suppression recommendations are separate operational guidance; this record contains no provider-specific practice.

• iana-smtp-enhanced-status-codesT0 source

  Enumerated Status Codes / X.7.21

• rfc5248T0 source

  Section 2.1: registry fields and non-exclusive Associated Basic Status Code

• rfc2034T0 source

  Section 4: enhanced status class agrees with SMTP reply class

• rfc7372T0 source

  IANA registry reference for X.7.21

• rfc6376T0 source

  IANA registry reference for X.7.21

Last verified: 17 July 2026