Fix Mailgun 550 5.1.9 Policy | Email List Validation

What causes the 550 5.1.9 policy violation in Mailgun?

You send a message through Mailgun, and it bounces with a 550 5.1.9 policy violation. Not a soft bounce. Not a timing issue. A hard reject. It’s not your recipient’s fault. It’s not Mailgun’s. It’s your domain’s DNS setup—specifically, missing or incorrect SPF, DKIM, or DMARC records.

This error happens when a receiving server checks your domain’s DNS and finds a mismatch between what you claim to send from and what your DNS actually allows. It’s like showing up at a bank with a forged ID that doesn’t match your picture: the system flags it instantly. If you’re setting up Mailgun for the first time or moving a domain to a new email provider, this is a common tripwire.

Fixing it isn’t about guessing. It’s about aligning your DNS records with Mailgun’s requirements. Once you get SPF, DKIM, and DMARC right, the 550 5.1.9 error disappears. And your emails start landing in inboxes—not the spam folder or trash.

Key takeaways

The 550 5.1.9 policy violation in Mailgun is triggered by a mismatch between your domain’s DNS records and your actual sending configuration.
Missing or misconfigured SPF, DKIM, or DMARC records are the most common root causes of this error.
Properly setting up these DNS records—especially SPF and DKIM—ensures receiving servers trust your domain and allow delivery.

How to configure Mailgun DNS settings to fix 550 5.1.9 policy violation 2025

You’re seeing a 550 5.1.9 policy violation because incoming mail servers are rejecting your Mailgun-sent emails due to missing or incorrect DNS records. Fix it by setting up SPF, DKIM, and DMARC in your domain’s DNS. Once configured, allow 5–15 minutes for propagation, then test delivery. These records verify your domain’s authenticity and prevent spoofing — a core requirement for modern email acceptance.

DNS Configuration Steps

Log in to your domain hosting provider's DNS management panel — such as Cloudflare, GoDaddy, or AWS Route 53. This is where you control your domain’s email authentication records.
Add an SPF record using the format v=spf1 include:mailgun.org -all. This authorizes Mailgun to send emails on your behalf. Without it, receivers treat your messages as unverified, often resulting in rejection.
Create a DKIM TXT record using the selector shown in your Mailgun control panel (e.g., mailgun._domainkey.yourdomain.com). Paste the full key value exactly as provided. DKIM cryptographically signs your emails to prove they weren’t altered in transit.
Set up DMARC by creating a TXT record at _dmarc.yourdomain.com with policy="none" or policy="quarantine". Starting with "none" lets you monitor alignment without blocking messages. DMARC defines how receivers handle emails that fail SPF or DKIM checks.
Save and wait 5–15 minutes for DNS changes to propagate globally. This is when the new records become visible to email servers worldwide.
Test your delivery using Mailgun’s API or sending a test message to a known inbox. Monitor for bounce codes or rejections — if the 550 error persists, double-check DNS syntax and propagation.

Why DNS Records Matter

SPF, DKIM, and DMARC are industry-standard email authentication practices. According to RFC 7001, SPF is critical for sender validation; DKIM adds cryptographic proof of message integrity. DMARC ties both together and enforces policies. Together, they prevent spoofing and improve inbox placement — a requirement for sending at scale.

The 6 steps described in “DNS Configuration Steps”, in order.

Even small errors in syntax — like missing a period, using the wrong selector, or placing a record in the wrong subdomain — can trigger rejections. Always copy the full key from Mailgun’s panel. Use tools like MXToolbox or dmarcanalyzer.com to verify records after setup.

For high-volume senders, verify your domain’s list hygiene before sending. A clean, valid list reduces delivery friction. You can test list quality with a bulk verification tool: clean your list before sending to avoid reputation issues.

Why SPF, DKIM, and DMARC matter for Mailgun deliverability

Without properly configured SPF, DKIM, and DMARC records, Mailgun emails are likely to fail delivery or land in spam, even if your content is clean. These DNS records are how receiving servers verify your identity, prove email integrity, and enforce sender policies. Skipping any one of them increases the risk of your messages being rejected with a 550 5.1.9 policy violation — especially under stricter inbound filtering in 2025.

Your email’s digital passport

SPF acts as a whitelist: it tells mail servers which IP addresses are authorized to send emails on behalf of your domain. If your Mailgun sending IP isn’t listed in your SPF record, receiving servers assume you’re impersonating your domain — a red flag for deliverability.

DKIM adds a cryptographic signature to each message. It’s like a digital seal: once your email leaves Mailgun, the signature ensures it hasn’t been altered in transit. Receiving servers verify this signature using your public key published in DNS. If the signature doesn’t match, the email is treated as potentially tampered with.

Policies matter — and they’re enforced

DMARC ties SPF and DKIM together. It tells receiving servers what to do if either SPF or DKIM fails — reject, quarantine, or allow. You can also set up DMARC reporting to track delivery attempts and identify spoofing attempts. Without DMARC, receiving servers have no consistent policy, which leads to inconsistent filtering and poor inbox placement.

For Mailgun users, this means that even a single misconfigured record can result in a 550 5.1.9 policy violation — especially for domains with a new or weak sending history. According to industry benchmarks, domains with full SPF/DKIM/DMARC alignment see 30% higher inbox placement rates, especially for high-volume senders.

Let’s be clear: you don’t need to guess. Use a DNS validator like MXToolbox or RFC 7483 to test your records in real time. If your SPF is too long, you might need to use a mechanism like SPF delegation or include records for third-party services like Mailgun. For DKIM, ensure you’re using a dedicated selector and that your public key is publicly available in DNS.

Don’t leave deliverability to chance. Test your domain’s alignment before sending. And if you’re cleaning or verifying a large list of addresses — ensure you’re not sending to invalid or risky emails that could harm your sender reputation. Use bulk email list cleaning to catch invalid addresses before they hit Mailgun.

How to verify your DNS configuration is correct

Run a DNS lookup with a tool like MXToolbox to confirm SPF, DKIM, and DMARC records are published. Send a test email through Mailgun, open the full headers, and check for a valid DKIM-Signature and SPF pass. Ensure the From domain matches the authenticated domain. These steps isolate misconfigurations that cause 550 5.1.9 policy violations in 2025.

Check your DNS records with public tools

Use MXToolbox to verify SPF, DKIM, and DMARC records are published for your sending domain.
Paste your domain into the tool’s DNS lookup fields and review the results for syntax errors, missing records, or conflicting policies.
Check that SPF only includes authorized servers (like Mailgun’s IP ranges) and doesn’t exceed DNS lookup limits.
Confirm DKIM is set up with a valid selector and public key, and that the selector matches the one in the email headers.
Ensure DMARC policy (p=) is set to either none, quarantine, or reject—a missing or malformed DMARC record can trigger filtering.

Examine the email headers from a test send

Send a test message from Mailgun to your personal inbox and open it in a client that shows full headers (like Gmail's "Show original").
Look for a DKIM-Signature: header. It must include a valid signature and pass validation.
Check for Received-SPF: pass in the headers. A fail or neutral indicates SPF misconfiguration.
Verify the From: domain in the email header matches the domain used in your SPF and DKIM records.
Use RFC 7208 to cross-reference SPF record syntax and ensure it adheres to industry standards—especially with v=spf1 and mechanisms like include:spf.mailgun.org.

Common issues in 2025: SPF records with too many includes, mismatched domains in From vs. authentication, or missing DKIM keys. Fixing these reduces 550 5.1.9 errors. If you're sending to a large list, use an email validation service to remove invalid addresses before sending — bulk list cleaning helps maintain strong sender reputation and avoid delivery blocks.

Common DNS configuration mistakes that trigger 550 5.1.9

You’re seeing a 550 5.1.9 policy violation when sending via Mailgun because your DNS setup violates basic email authentication rules. The most common issues are multiple SPF records, incorrect DKIM selectors, overly strict SPF policies like -all without proper authorization, or sending before DNS changes fully propagate. These errors trigger rejection by receiving servers that enforce strict validation. Fixing them is straightforward—just ensure one SPF, correct DKIM syntax, and allow propagation time.

Multiple SPF records break email authorization

You can only have one SPF record per domain. If you’re adding multiple SPF entries—say, one for Mailgun and one for another service—you’re breaking a core DNS rule. Receiving servers see this as a configuration error and reject the message. Even if the content is valid, a duplicate SPF record triggers a 550 5.1.9 response. Use a single SPF record that includes all authorized senders with the correct syntax, like include:mailgun.org.

DKIM selector mistakes cause signature validation failure

The DKIM selector must match exactly what’s configured in Mailgun. If you use a selector like mailgun but reference mailgun._domainkey incorrectly—e.g., missing the dot, or using a subdomain like mailgun.staging—the receiving server won’t find a valid signature. This results in authentication failure. Always double-check that your DNS TXT record uses the full selector and domain name as provided by Mailgun. The DKIM specification requires exact alignment.

Overly strict SPF policies block legitimate traffic

If you set SPF policy to -all and haven’t fully authorized all senders, you risk rejecting your own mail. The -all mechanism means “reject anything not in the list.” If you include Mailgun but forget a legitimate sender like your CRM or support system, those messages fail. Use ~all (soft fail) during setup to avoid accidentally blocking valid mail while testing. Only switch to -all once all sending sources are confirmed.

DNS changes take time to propagate

You cannot send immediately after updating DNS. Propagation varies by network but can take 24–48 hours, especially for global providers. Sending before this window ends often results in 550 5.1.9 errors, even if the record is correct. Use tools like MxToolbox to verify your new SPF or DKIM records are live. For high-volume or time-sensitive sends, validate DNS status before sending to avoid delivery failures.

Does email list validation help prevent 550 5.1.9 errors?

No, email list validation won’t fix DNS misconfigurations that cause 550 5.1.9 policy violations. That error comes from sender policy issues—like missing or incorrect SPF, DKIM, or DMARC records. Validating your list doesn’t resolve those. But it does help you avoid sending to invalid addresses, which could lead to bounce loops, reputational harm, or trigger spam filters if too many bad sends accumulate.

What list validation actually stops

You might be sending to role accounts like admin@ or sales@, disposable email domains, or malformed addresses—these often don't accept mail and can trigger automatic bounces. Over time, a high volume of bounces, even from invalid recipients, damages your sender reputation. That’s a known risk factor in email deliverability, as noted by the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG).

Using a tool like bulk email list cleaning lets you catch those issues before sending. You’ll see which addresses are risky, invalid, or possibly disposable. Removing them means fewer bounces, less strain on your sending domain’s reputation, and better long-term inbox placement.

How it fits into your deliverability stack

Think of list validation as a hygiene layer—not a fix for broken DNS. If your SPF record is missing, no amount of list cleaning will fix that. But if you’re seeing repeated 550 5.1.9 errors, it’s worth checking your DNS first, then validating your list to ensure you aren’t sending to dead zones.

Let’s be clear: you can’t avoid policy violations by cleaning names. But you can keep your domain’s reputation from suffering due to high bounce rates. A cleaner list means fewer failed deliveries, which helps maintain trust with inbox providers. This is an industry-standard practice, and tools that support real-time validation—like our real-time API—can integrate directly into your signup or campaign workflows.

In short: validation doesn’t fix DNS setup, but it stops your list from worsening problems that can indirectly trigger delivery failures. It’s not a cure-all—but it’s a smart, measurable step in preventing reputational damage.

How to integrate Email List Validation with Mailgun

You can prevent Mailgun’s 550 5.1.9 policy violations by cleaning your list before sending. Use the Email List Validation API to check addresses in real time, run bulk verification to flag invalid, catch-all, or risky emails, and remove them before uploading to Mailgun. This cuts your send volume, reduces bounce rates, and helps avoid throttling or blocklisting.

Step-by-step integration process

Verify your list before uploading Use the Email List Validation API to test each address as you build your list. This catches invalid formats, nonexistent domains, or blocked addresses early. You’re not just checking syntax—you’re verifying deliverability. Test your list live with 98.9% accuracy to prevent wasted sends and reputation damage.
Run bulk verification via the web interface Upload your entire list to the Email List Validation platform. The system checks each email against SMTP, MX, and DNS records, flagging invalid, catch-all, or risky addresses. The output is a clean, validated list you can trust. This step is crucial—according to RFC 5321, servers reject messages to non-existent addresses with a 550 error, which Mailgun enforces strictly.
Filter out unsafe addresses Remove all entries marked as invalid, catch-all, or risky before importing into Mailgun. Catch-all mailboxes accept all emails, even invalid ones, which increases bounce rates and harms sender reputation. Letting these through can trigger automated policy violations like 550 5.1.9, especially in 2025 when enforcement is tightening.
Import only verified addresses Upload your cleaned list to Mailgun. Fewer sends mean lower risk of hitting rate limits or being flagged for high bounce rates. Mailgun’s systems are tuned to detect patterns that suggest spam or list abuse—cleaner lists avoid those red flags.

Why this works

High bounce rates and rejected emails hurt sender reputation. A single 550 error can trigger throttling, especially if repeated. By proactively filtering bad addresses, you reduce volume, avoid policy violations, and improve inbox placement. This isn’t just a cleanup task—it’s a deliverability safeguard. For teams using Email List Validation, the bulk verification tool is designed to integrate directly with platforms like Mailgun to streamline this workflow. Keep your list sharp, your reputation clean, and your messages reaching inboxes.

Why sender reputation affects Mailgun deliverability

You can properly configure Mailgun’s DNS settings, but if your sending list includes invalid addresses, high bounce rates, or unengaged recipients, your domain’s reputation will still suffer. Bad reputation leads to inbox filtering, throttling, or outright blocking—even with correct SPF, DKIM, and DMARC. Your deliverability isn't just about technical setup; it’s about who you’re sending to.

Reputation starts with list hygiene

Every time you send to an invalid or unengaged email, you’re damaging your sender reputation. Mailgun’s infrastructure tracks your sending behavior, and if it detects a high number of bounces or spam complaints, it treats you as a potential spam source. This isn’t theoretical—industry standards from organizations like Spamhaus and Return Path confirm that sender reputation directly influences filtering decisions.

Even a single high-volume campaign to outdated data can trigger a 550 5.1.9 policy violation. That error isn’t just about DNS misconfiguration—it’s often a signal that your domain is flagged due to poor sending practices. If one recipient marks your message as spam, it counts. If 1% of your recipients bounce, email providers see that as a red flag.

Maintaining reputation requires consistency

The goal is to keep your bounce rate under 0.5% and spam complaint rate below 0.1%. That’s not negotiable if you want to stay in inboxes. High volumes of invalid addresses, including disposable emails or role accounts, degrade your reputation over time. Even if your DNS is perfect, the mail server will quietly reject your messages.

You’re not just avoiding penalties—you’re building trust. Email providers like Gmail and Outlook use reputation metrics to determine whether your messages land in the primary inbox or the promotions tab. The better your reputation, the higher the likelihood your Mailgun-sent emails are delivered and opened.

That’s why DNS setup is only the first step. You must maintain clean, engaged lists. Use proactive verification to catch invalid emails before you send. Real-time tools help prevent issues before they happen. For example, bulk email list cleaning identifies bad addresses, disposable domains, and high-risk addresses before they harm your deliverability.

The right tools don’t just fix errors—they stop them. With consistent list hygiene, you sustain high inbox placement and avoid 550 errors related to policy violations. It’s not a one-time fix. It’s ongoing maintenance.

Is there a way to test if a domain is fully configured for Mailgun?

You can test whether your domain is fully configured for Mailgun by sending a real email to a verified inbox through Email List Validation’s inbox-placement test. This check goes beyond DNS records—it verifies if SPF, DKIM, and DMARC are correctly set up and whether the message actually lands in the inbox instead of spam. It’s the only way to confirm your entire email stack works together.

Testing the full delivery stack with real inboxes

Configuring DNS records is just the start. Even if SPF and DKIM are set properly, your message might still end up in spam. That’s why testing across real provider inboxes—Gmail, Outlook, Yahoo, Proton—is critical. Email List Validation’s inbox-placement test simulates a real delivery by sending a message to known-good email addresses across major providers.

This test confirms not just DNS alignment but also whether your domain has a healthy sender reputation, whether your content is flagged, and whether your infrastructure (like IP reputation and sending patterns) passes real-world scrutiny. You’ll get a full breakdown: did the email pass authentication? Was it delivered to the inbox? Or was it flagged as spam?

How it works and why it matters

When you run an inbox-placement test, the service checks the full chain: DNS setup, authentication headers (SPF, DKIM, DMARC), content reputation, and inbox placement. It’s not a synthetic test—it uses live mailboxes to validate actual delivery behavior. This mirrors what happens when you send to real users.

For Mailgun users, this means you can catch issues before sending to your audience. A 550 5.1.9 policy violation in 2025 usually points to a misalignment in authentication or sender reputation—this test surfaces those issues early. It’s not just about DNS correctness; it’s about proving your domain can reliably deliver.

For a deeper check, you can also validate your entire list using the bulk email list cleaning feature, which includes real-time bounce and deliverability checks. It verifies every email in your list—not just the DNS—but helps you avoid sending to invalid or risky addresses that could harm your reputation. RFC 7208 (the DMARC standard) and industry reports from sources like Spamhaus confirm that authentication failures are a top reason for email rejection—even with correct DNS. Test it before you send.

How does Email List Validation improve overall deliverability?

You improve deliverability by catching invalid, disposable, and risky email addresses before they hit Mailgun’s servers. This stops bounces, prevents sender reputation damage, and reduces the chance of being flagged as spam — all before a single message is sent. The result? Higher inbox placement, fewer 550 policy violations, and a cleaner, more reliable sending record.

Preventing failures before they happen

When you’re using Mailgun, every rejected address — especially from role-based or disposable domains — can trigger a 550 5.1.9 policy violation, even if the domain itself is valid. These errors often stem from sending to low-quality or non-existent addresses. Email List Validation catches these early by testing each email in real time. You’re not guessing; you’re filtering out bad data before it ever reaches Mailgun’s infrastructure.

Integration at scale: accuracy and automation

With a 98.9% accuracy rate, Email List Validation outperforms most tools in real-world use. It goes beyond basic syntax checks, identifying catch-all domains, role accounts (like admin@, sales@), and disposable email providers that hurt sender reputation over time. Let’s be clear: sending to role accounts is a red flag for modern email providers. These addresses often don’t engage and can be flagged as spam sources.

Integrating the real-time verification API directly into your workflow — before you push to Mailgun — means you catch these issues automatically. It's not a one-off check; it’s part of your sending pipeline. When you verify at scale, you prevent reputation drift. This aligns with industry practices like those outlined in RFC 5321 and RFC 5322, which emphasize sender responsibility in email hygiene.

For teams using Mailgun at scale, combining this with tools like SendGrid or HubSpot (via our integrations) makes validation seamless. You reduce technical delivery issues while focusing on engagement, not bouncebacks.

Final steps to fix 550 5.1.9 and maintain delivery stability

The 550 5.1.9 policy violation often signals misaligned DNS or sender authentication. Double-check every DNS record—SPF, DKIM, DMARC—using a third-party tool like MxToolbox or Google's Admin Toolbox to catch syntax or configuration errors before they trigger blocks.

Essential ongoing practices

Ensure your sending domain matches the From address in every email. Mismatched domains are a common cause of policy violations.
Use Email List Validation to clean your list before sending. Invalid, catch-all, or disposable emails increase bounce rates and hurt sender reputation.
Review bounce reports and spam complaints monthly. Persistent issues may indicate list hygiene or content problems.
If this is a new domain, gradually increase sending volume (warm-up) over 2–4 weeks. Rapid volume spikes trigger automated defenses.

Fixing a 550 5.1.9 error isn’t a one-time task. It’s part of a consistent approach to maintaining sender reputation and inbox placement.

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

How long does it take for DNS changes to fix 550 5.1.9?

DNS changes typically propagate within 5 to 15 minutes. If the error persists, verify the records and test delivery again.

Can I use multiple SPF records?

No. Only one SPF record is allowed per domain. Combine all authorized senders into a single include statement.

What does policy violation 550 5.1.9 mean?

It means the receiving server rejected your email due to a policy mismatch, usually because SPF or DKIM verification failed.

Does Email List Validation work with Mailgun?

Yes. You can use the Email List Validation API to clean your list before sending via Mailgun, improving deliverability.

Why do some emails bounce after fixing DNS?

Bounces may still happen due to invalid or non-existent email addresses—clean your list first.

What’s the best SPF policy for Mailgun?

Use 'v=spf1 include:mailgun.org -all' to authorize Mailgun and block all others.

Can DKIM alone fix 550 5.1.9 errors?

No. DKIM is one layer, but SPF and DMARC are required for full authentication. All three must be correct.

How do I know if my DMARC record is working?

Check your DMARC reports at email-dmarc.com or use a third-party analyzer. Look for alignment and policy enforcement.

Do I need to warm up a Mailgun domain?

Yes, especially for new domains. Start with small volumes and increase gradually to build reputation.

Can disposable emails cause delivery issues?

Yes. Disposable domains often trigger spam filters. Email List Validation identifies them for removal.

What happens if I don’t fix 550 5.1.9 errors?

Your messages will be rejected or go to spam, reducing engagement and damaging sender reputation.

Can Email List Validation detect catch-all email addresses?

Yes. It returns “catch-all” when an address is deemed valid but not reliably deliverable, helping avoid bounce risk.