# 5.7.32 Bounce: From Header Not Aligned (Gmail)

URL: https://email-validation.org/bounce-codes/5-7-32/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

**At a glance**

- **Type:** permanent failure (class 5, RFC 3463 §2). The sending server does not retry; sending the same message again fails the same way until the cause is fixed.
- **Basic code:** varies; the enhanced code is the part that identifies the problem.
- **Enhanced code 5.7.32:** not in the IANA registry; the group is security or policy status (RFC 3463 §3.8).
- **Who uses it:** Google (Gmail): the From: header is not aligned with the SPF or DKIM domain.

A 5.7.32 bounce from Gmail means the domain in your From: address matches neither the domain that passed SPF nor the domain that signed with DKIM. Authentication passed for someone, just not for the domain your recipient sees.

## What it means

This is Google's code, and its meaning comes from [Google's SMTP error reference](https://support.google.com/a/answer/3726730), which uses it in two forms:

- **421 4.7.32:** the From: header is not aligned with the SPF or DKIM domain, and Gmail rate limits your mail.
- **550 5.7.32:** the same problem, and Gmail blocks the message.

"Aligned" is the DMARC idea: the domain that passes SPF (the envelope sender) or the domain in the DKIM signature has to match the From: domain. Without that match, DMARC fails, even though SPF and DKIM pass on their own.

## Common causes

- A sending service signs with its own domain, so the DKIM `d=` value is the service's domain, not yours.
- The service uses its own bounce domain as the envelope sender, so SPF passes for the service, not for you.
- You send with a From: address on one domain through a system set up for another (a second brand or a parent company).
- A subdomain is used for sending, and the From: uses a different subdomain or the parent domain.

## How to fix it

1. Look at a delivered copy. Compare three domains: the From: address, the Return-Path (the envelope sender), and the `d=` in the DKIM-Signature header.
2. Set up custom DKIM in each sending service, so it signs with your From: domain. Check the key with the [DKIM checker](https://email-validation.org/tools/dkim-checker/).
3. Where the service supports it, set a custom bounce (return-path) domain under your own domain, and include the service in your SPF record ([SPF checker](https://email-validation.org/tools/spf-checker/)).
4. Check your DMARC record and the result with the [DMARC checker](https://email-validation.org/tools/dmarc-checker/).
5. [Google's sender guidelines](https://support.google.com/a/answer/81126) require From-domain alignment from bulk senders (around 5,000 or more messages a day to personal Gmail accounts). One aligned method is enough.

## What to do with the address

Keep it. The mailbox is fine; the fix is in your sending setup. For the related checks, see [5.7.26](https://email-validation.org/bounce-codes/550-5-7-26/) (no SPF or DKIM pass at all) and [5.7.40](https://email-validation.org/bounce-codes/550-5-7-40/) (no DMARC record).

## Related codes

- [550 5.7.26](https://email-validation.org/bounce-codes/550-5-7-26/): Unauthenticated: SPF and DKIM failed, or DMARC rejected it
- [550 5.7.30](https://email-validation.org/bounce-codes/550-5-7-30/): DKIM failed for a bulk sender (Gmail)
- [550 5.7.40](https://email-validation.org/bounce-codes/550-5-7-40/): No DMARC policy for a bulk sender (Gmail)

See [every bounce code](https://email-validation.org/bounce-codes/) in the dictionary.

Many bounces from addresses that do not exist can be avoided: check an address with our [free email checker](https://email-validation.org/email-checker/), or [clean a whole list](https://email-validation.org/bulk-email-verification/) before you send.