Yahoo 550 5.7.9: why Yahoo says the sender is unauthenticated, and how to fix it

What the bounce says

The most common version of this bounce reads: "550 5.7.9 This mail has been blocked because the sender is unauthenticated. Yahoo requires all senders to authenticate with either SPF or DKIM." Some versions instead say Yahoo requires the sender to authenticate with DMARC, meaning DMARC-aligned DKIM or DMARC-aligned SPF, and list the SPF and DKIM results for the message.

550 is a permanent rejection. Yahoo's own guidance says not to retry a message that comes back with a 5xx error, so the fix has to happen before you send again. The bounce is about your domain and sending setup, not about the recipient, so don't remove the address from your list just because of this code.

What Yahoo requires

Yahoo publishes its rules on its Sender Hub. Since February 2024 it has enforced these requirements:

• All senders: authenticate with SPF or DKIM at a minimum, keep the spam complaint rate below 0.3%, have valid forward and reverse DNS for sending IPs, and follow the email standards RFC 5321 and RFC 5322.
• Bulk senders: authenticate with both SPF and DKIM, and publish a DMARC policy of at least p=none that passes. The domain in your From address must align with the SPF domain or the DKIM domain. Relaxed alignment is fine.
• Bulk senders also need a working one-click unsubscribe header and a visible unsubscribe link in marketing and subscribed mail, and must honor unsubscribes within 2 days.

Yahoo also recommends DKIM keys of at least 1024 bits and a DMARC rua reporting address so you can see who is sending as your domain while you set things up.

Step 1: check what your domain publishes

Run your sending domain through the free checker. It looks up SPF, DKIM, DMARC and MX in one go. Look for:

• Exactly one SPF record starting with v=spf1 that includes the service that actually sends your cold email, within the 10-lookup limit. See SPF record too many lookups.
• A DKIM key for the selector your mail provider signs with. See DKIM selector not found in Google Workspace.
• A DMARC record at _dmarc.yourdomain.com with a p= tag. See DMARC policy for cold email.

Step 2: read the headers of a real message

Records can look fine while the message still fails, for example when a sending tool signs with its own domain. Send a test from the exact mailbox and tool you use for outreach to a Yahoo address you own, open it, and view the raw message. The Authentication-Results header shows the SPF, DKIM and DMARC results Yahoo saw.

Check the domains as well as the pass or fail. For DMARC, the domain that passed SPF (the Return-Path domain) or DKIM (the d= value in the signature) has to match your From domain. If DKIM passes for your tool's domain instead of yours, set up custom DKIM in that tool.

Step 3: fix the usual causes

1. A new tool or mailbox provider was connected without being added to SPF or getting DKIM. Add its include to your one SPF record and publish its DKIM key.
2. You only set up SPF, and the message went through a server SPF does not list, such as a forwarder or a different relay. Set up DKIM so the message can pass without depending on the sending IP.
3. Two SPF records on one domain, or an SPF record over 10 lookups. Both make SPF fail. Merge or trim to one valid record.
4. DKIM was published but never switched on. In Google Workspace you also have to click Start authentication in the admin console; Microsoft 365 has its own DKIM switch.
5. You send through an outreach tool with a free address like @yahoo.com or @aol.com in the From line. Those domains publish strict DMARC policies, so mail sent through a third-party service fails DMARC. Use your own domain.
6. Your DMARC policy is quarantine or reject while some senders still fail. Go back to p=none, fix those senders, then tighten it again.

Related Yahoo bounces

Yahoo groups its errors by cause. If you see a different message, the fix is usually different:

• Temporary deferrals (421 or 451), including codes that start with TS: Yahoo is slowing you down because of complaints, spam-like content, a poor IP reputation or unusual traffic. Your server can retry later, but reduce volume and look at what changed.
• Other 553 and 554 rejections: these can mean an invalid address, a DMARC or DKIM policy failure, content Yahoo won't accept, or an IP listed by Spamhaus. Check whether your domain or IP is listed with our blacklist guide.
• Recipient does not exist: that address is invalid. Remove it and don't retry.

Yahoo's wording changes from time to time, so compare what you see with its current SMTP error codes page on the Sender Hub.

Test, then keep it from coming back

DNS changes take time to spread, depending on the old record's TTL. Re-run the checker until it shows the new values, send one test to Yahoo, and confirm SPF, DKIM and DMARC all pass before you resume a campaign. Only resend to people you still intend to contact, and leave out anyone who asked you to stop.

Authentication tends to break quietly when someone edits DNS or connects a new tool. OutboxWatch's paid plans re-check SPF, DKIM, DMARC, MX and blacklists every day and flag changes; the free checker is there any time you want a quick look. For Gmail and Outlook, see Gmail 550 5.7.26 and Outlook 550 5.7.515.