Yahoo 550 5.7.9 and 554 5.7.9: Fix Authentication Bounces

A Yahoo bounce can say the sender is unauthenticated or explicitly refer to the sending domain's DMARC policy. Those messages point to different checks, even when the numeric codes look similar.

Use the complete response to decide what to investigate. Yahoo distinguishes authentication requirements from other rejection reasons in its Sender Hub.

“550 5.7.9 … the Sender Is Unauthenticated”

 
The following supplied example has been anonymized; the domain and IP are placeholders:

550 5.7.9 This mail has been blocked because the sender is unauthenticated.

Yahoo requires all senders to authenticate with either SPF or DKIM.

Authentication results:

DKIM = FAILURE

SPF example.com with ip 192.0.2.45 = FAILURE

The stated problem is failed authentication. The response does not establish that your DMARC record is:

• missing;
• malformed;
• set to the wrong policy.

Yahoo requires SPF or DKIM for all senders. Bulk senders must:

• use SPF;
• use DKIM;
• publish DMARC;
• pass its checks.

Do not assume Yahoo defines bulk volume using another provider's threshold. See Yahoo sender requirements and Yahoo FAQ.

Start by identifying the outgoing service.

If you use an email client with a custom From address:

• Verify which SMTP account actually sends the message.

If a website or application sends it:

• Check that application's mail configuration.

Then inspect a fresh message from that route:

• Is there a DKIM signature?
• Which envelope domain does SPF evaluate?
• Does the service's custom-domain setup match those identities?

“554 5.7.9 … Sending Domain's DMARC Policy”

 
This branch explicitly identifies DMARC.

Investigate:

• whether the authenticated domains align with the visible From domain;
• whether an intermediary changed the message.

A generic 554 5.7.9 response mentioning only policy reasons is less specific. Yahoo's own help describes DMARC as a possible explanation rather than a diagnosis for every occurrence.

Keep the full diagnostic instead of expanding the code into a cause it does not state. See Yahoo delivery-error help.

When working with a third-party sending platform:

1. Ask it to verify the custom DKIM domain.
2. Check the supported return-path configuration for your account.
3. Send another message only after the platform confirms the configuration is active.

What the Older AOL “521 5.2.1 (DMARC)” Response Tells You

 
An older supplied example reads:

521 5.2.1 : (DMARC) This message failed DMARC Evaluation

and is being refused due to provided DMARC Policy

Here, the explicit DMARC text guides the investigation.

Treat it as:

• an observed wording variant;
• not a universal definition of 521 or 5.2.1;
• not a claim about the code AOL always returns today.

For an actual incident, preserve the remote mail-server hostname along with the response.

A copied error fragment without its original receiving system provides less context.

Check Forwarding Separately

 
Send:

1. One test directly.
2. One test through the failing forwarding path.

Forwarding may break SPF, while changes to signed content may break DKIM. That combination can remove the authentication path on which DMARC depended. See DMARC and indirect mail flows.

If the direct message succeeds and the forwarded version fails:

• involve the forwarding service;
• do not add its IP to every original sender's SPF record as a general repair;
• keep the two test results together so support can inspect where the route changed.

Resume Sending After a Verified Test

 
An authentication rejection does not prove that the recipient's mailbox is invalid.

Instead:

1. Pause the affected sending flow.
2. Repair the authentication issue.
3. Verify a small test before considering a resend.

Review any ESP suppression caused by the incident according to that provider's process. Do not automatically reactivate an entire suppressed list.

For the initial DNS check, use the DMARKOFF DMARC Checker.

After connecting the report collection, use DMARKOFF to compare authentication across reported sources.
 
Start 14-day Free Trial
 
Keep your ESP's bounce logs alongside that monitoring:

• Bounce logs show which individual deliveries failed.
• DMARC aggregate reports help reveal recurring source-level authentication problems.

By identifying the exact Yahoo rejection message and testing the affected sending route, you can fix the underlying authentication issue without making unnecessary changes to your email setup.

FAQ