TL;DR
Permanent rejection: verified DKIM exists but none matches a From author address. Align From identity with a valid signing domain before retrying. A From/DKIM mismatch is a reputation and anti-spoofing policy risk. Do not retry unchanged.
What this code means
Author alignment drives code 5.7.22 under registry pattern X.7.22: at least one DKIM signature passes verification, yet no passing signature identifier matches any address in the From header field. Class 5 assigns a permanent failure in the enhanced status register. The detail targets anti-spoofing identity checks rather than general DKIM validity. It confirms verification success paired with an author mismatch, without showing whether From, the signing domain, or a relay that altered headers caused the gap.
Technical meaning
At least one passing DKIM signature is present under X.7.22, but no passing DKIM signature has an identifier that matches any author address found in the From header field. This is a special case of X.7.21 and, by definition, violates the advice in Section 6.1 of RFC 6376. Code 5.7.22 applies that detail in the permanent-failure class.
Delivery status
The leading digit 5 denotes a permanent failure of the current attempt. The code confirms that at least one DKIM signature passed verification; the problem is that its identifier does not match an author in the From field, not that every DKIM signature is invalid. The code alone does not identify the layer where the mismatch arose.
- Class
- Permanent failure
- Retry
- Do not retry unchanged
- Suppression
- Check the full context
Retry decision
Operational guidance: stop automatic and manual retries of the same unchanged attempt because they will not change the match between the DKIM identity and the author. Consider a new, controlled attempt only after a confirmed correction and verification that at least one DKIM signature both passes and is author-matched; check suppression again first.
Suppression decision
Operational guidance: do not automatically suppress the recipient address or domain based on 5.7.22 alone. Inspect the complete response, From field, DKIM results, configuration of the systems involved, and event history, then make the suppression decision according to the confirmed cause and applicable policy.
Common causes
- The message contained at least one passing DKIM signature, but no passing DKIM signature had an identifier matching any author address in the From field.
Diagnostic steps
- Inspect the raw SMTP response or nondelivery report and confirm the exact 5.7.22 code and a basic reply in the 5xx class; retain the complete response text.
- Correlate the response with the intended message, attempt time and stage, and system that returned the code. In the message copy from the evaluation point, inspect the From field, DKIM-Signature headers, and available verification results or logs, and confirm that at least one signature passed.
- Compare the identifiers of every passing signature with the author address or addresses in the From field. Inspect signing, transport, and verification logs and configuration to establish where the mismatch arose, without assigning responsibility from the code alone.
- Stop unchanged retries. After a confirmed correction, demonstrate that at least one DKIM signature passes and is author-matched, check suppression again, and make one controlled attempt.
Actions by owner
Sender
- Do not repeatedly send the same unchanged message; give the administrator the complete response and attempt time without exposing message content or secrets.
Sender administrator
- Inspect the From field in the sent message and the signing and transport logs and configuration; establish why no passing DKIM signature was author-matched, then correct only the confirmed cause.
- After the correction, confirm that at least one DKIM signature passes and is author-matched, check suppression again, and make one controlled attempt instead of retrying the unchanged message.
Recipient administrator
- If you manage the system that returned the code, inspect its DKIM verification and author-matching logs and configuration for the specified attempt; correct a confirmed receiving-side problem or safely give the sender the result needed for remediation.
Provider
- If you operate a managed signing, transport, or verification layer, inspect its logs and configuration for the attempt, correct a confirmed problem in that layer, and do not trigger suppression from the code alone.
Sources
These sources define what this enhanced status code means, mainly through the IANA registry and related RFCs. When provider examples appear on the page, they come from that provider's published documentation. Follow the links to read the original wording in context.
- SMTP Enhanced Status Codes — IANA registry of enhanced mail system status codes.
- RFC 5248 — A Registry for SMTP Enhanced Mail System Status Codes — Creates and governs the IANA enhanced status code registry.
- RFC 2034 — SMTP Service Extension for Returning Enhanced Error Codes — Defines how SMTP returns enhanced status codes to clients.
- RFC 7372 — Email Authentication Status Codes — Status codes for SPF, DKIM, DMARC and related authentication results.
- RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures — DKIM signature standard for authenticating email domains.
Last verified:
