5.7.32: From: domain not aligned with SPF or DKIM (Gmail)
At a glance
- Type: permanent failure (class 5, RFC 3463 §2). The sending server does not retry; sending the same message again fails the same way until the cause is fixed.
- Basic code: varies; the enhanced code is the part that identifies the problem.
- Enhanced code 5.7.32: not in the IANA registry; the group is security or policy status (RFC 3463 §3.8).
- Who uses it: Google (Gmail): the From: header is not aligned with the SPF or DKIM domain.
A 5.7.32 bounce from Gmail means the domain in your From: address matches neither the domain that passed SPF nor the domain that signed with DKIM. Authentication passed for someone, just not for the domain your recipient sees.
What it means
This is Google's code, and its meaning comes from Google's SMTP error reference, which uses it in two forms:
- 421 4.7.32: the From: header is not aligned with the SPF or DKIM domain, and Gmail rate limits your mail.
- 550 5.7.32: the same problem, and Gmail blocks the message.
"Aligned" is the DMARC idea: the domain that passes SPF (the envelope sender) or the domain in the DKIM signature has to match the From: domain. Without that match, DMARC fails, even though SPF and DKIM pass on their own.
Common causes
- A sending service signs with its own domain, so the DKIM
d=value is the service's domain, not yours. - The service uses its own bounce domain as the envelope sender, so SPF passes for the service, not for you.
- You send with a From: address on one domain through a system set up for another (a second brand or a parent company).
- A subdomain is used for sending, and the From: uses a different subdomain or the parent domain.
How to fix it
- Look at a delivered copy. Compare three domains: the From: address, the Return-Path (the envelope sender), and the
d=in the DKIM-Signature header. - Set up custom DKIM in each sending service, so it signs with your From: domain. Check the key with the DKIM checker.
- Where the service supports it, set a custom bounce (return-path) domain under your own domain, and include the service in your SPF record (SPF checker).
- Check your DMARC record and the result with the DMARC checker.
- Google's sender guidelines require From-domain alignment from bulk senders (around 5,000 or more messages a day to personal Gmail accounts). One aligned method is enough.
What to do with the address
Keep it. The mailbox is fine; the fix is in your sending setup. For the related checks, see 5.7.26 (no SPF or DKIM pass at all) and 5.7.40 (no DMARC record).
Related codes
- 550 5.7.26: Unauthenticated: SPF and DKIM failed, or DMARC rejected it
- 550 5.7.30: DKIM failed for a bulk sender (Gmail)
- 550 5.7.40: No DMARC policy for a bulk sender (Gmail)
See every bounce code in the dictionary.
Many bounces from addresses that do not exist can be avoided: check an address with our free email checker, or clean a whole list before you send.
How we wrote this: drafted by the email-validation.org team with the help of AI writing tools, from our product documentation and the sources linked in the text.