Fix Mailgun 550 5.7.1 SPF DMARC Errors

Why is your Mailgun API failing with 550 5.7.1 and 'sender not authorized'?

You sent an email through the Mailgun API. It worked in testing. But now your production campaigns are failing with a 550 5.7.1 error: “Sender not authorized.” You’re not seeing delivery issues with other tools. So why is Mailgun rejecting your message?

The short answer: the recipient server knows your domain but doesn’t trust it. This isn’t Mailgun’s fault. The error points to your domain’s DNS settings—specifically SPF and DMARC configuration. If those don’t align with Mailgun’s sending infrastructure, your emails get blocked before they even reach the inbox.

Think of SPF and DMARC like gates at a secure facility. Mailgun is the courier. If your gate doesn’t recognize the courier’s badge, or if the badge doesn’t match the authorized access list, the door stays closed—no matter how fast the delivery team is.

Key takeaways

The 550 5.7.1 error occurs when recipient servers reject emails due to missing or misconfigured SPF/DMARC policies, not due to Mailgun’s infrastructure
SPF must include Mailgun’s sending IPs or include a include:mailgun.org mechanism to authorize Mailgun as a sender
DMARC policies with p=reject or rua=mailto: must be set with care—overly strict policies can block legitimate Mailgun traffic if alignment fails

How SPF, DKIM, and DMARC work together to block unauthorized senders

You're blocked with a 550 5.7.1 error because your domain's SPF, DKIM, or DMARC records aren't set up correctly—or aren't aligned. SPF says which servers can send mail for your domain. DKIM verifies the email wasn't altered in transit with a cryptographic signature. DMARC tells receiving servers what to do when those checks fail—like reject or quarantine the message. If any one of these fails to align, your email gets flagged as unauthorized, especially by strict providers like Mailgun. A single misstep breaks the chain.

SPF: The Sender’s Permission List

SPF is your domain’s official list of approved sending servers. It’s a DNS record that says: “Only these hosts can send emails from my domain.” If Mailgun or your ESP isn’t on that list, the recipient server sees your email as spoofed—even if you’re sending from a valid address. This is why sending from a new provider or reseller requires updating SPF records.

For example, if your SPF record includes only your in-house mail server and not Mailgun’s IP range, Mailgun will fail SPF checks. Always include all authorized sending IPs or services in your SPF record.

DKIM: The Email's Digital Signature

DKIM adds a cryptographic signature to every outgoing email, attached to its headers. The receiving server checks this signature using your domain’s public key in DNS. If it doesn’t match, the email is altered—or forged—during transit.

It’s not about who sent it, but whether the content stayed intact. A failed DKIM check doesn’t always block delivery, but it weakens sender reputation and increases the chance of filtering.

DMARC: The Enforcement Policy

DMARC ties SPF and DKIM together by telling the receiving server what to do when either fails. You can set it to monitor, quarantine, or reject mail. Setting it to reject means any email failing SPF or DKIM gets blocked.

This is crucial for large-scale sending. If your DMARC policy is set to reject but your SPF or DKIM isn’t properly configured, your emails won’t get through—this is exactly what triggers the 550 5.7.1 error you’re seeing.

A well-aligned setup—where SPF, DKIM, and DMARC all work together—builds sender trust. According to the IETF RFC 7483, alignment is required for DMARC enforcement to be effective. This means the "from" domain in the email header must match the domain used in SPF and DKIM checks.

Using a tool like bulk email list cleaning can help you catch domains with weak or misconfigured records before you send, reducing the chance of hitting blocking errors like 550 5.7.1.

When does Mailgun fail with 'sender not authorized' despite correct settings?

You might get a 550 5.7.1 error from Mailgun even with SPF, DKIM, and DMARC configured because some domains enforce strict policy enforcement, block senders whose IPs aren’t explicitly listed in the SPF record, or reject messages from senders with poor reputations—even if alignment checks pass. It's not just about technical correctness; reputation and recent sending behavior matter just as much.

SPF alignment isn’t enough if the IP isn’t in the record

SPF checks the sending IP against the domain’s SPF record. If Mailgun’s IP isn’t explicitly included, even a properly formatted record can fail. Some providers, especially large ones like Gmail or Microsoft, treat unlisted IPs as suspicious—even if the domain aligns. You can verify your Mailgun IP is in your SPF record using tools like MxToolbox or by checking your domain’s DNS with dig or nslookup.

DKIM signature errors or misconfigurations

Even with SPF and DMARC set, a failed DKIM signature will trigger rejections. If you’re using a custom domain with Mailgun, you must correctly publish the DKIM public key in your DNS. Common mistakes include incorrect selector names, missing or malformed TXT records, or failing to sign every message. You can test DKIM using RFC-compliant tools like rfc5322.org or third-party validation services.

Recent domain changes or sending spikes trigger filters

Sudden spikes in volume—like sending millions of emails in a single hour—can trip rate-based filters, even with valid authentication. Similarly, recent DNS changes (like adding SPF or switching mail providers) may take time to propagate, leading to inconsistent rejection patterns. Providers often apply defensive measures during such events until trust is restored.

Reputation issues can override technical alignment

Even with perfect SPF, DKIM, and DMARC, a poor sender reputation due to past abuse, high bounce rates, or spam complaints can result in permanent rejection. Email providers track long-term behavior. If your domain or IP was previously flagged for spam, you may still be blocked regardless of current settings.

Authenticity doesn’t guarantee deliverability—reputation does.

Before assuming your config is broken, verify you’re not hitting a rate limit, a reputation filter, or a DNS propagation delay. Use real-time verification tools to scrub your list before sending. Clean your list upfront to ensure only valid, engaged addresses are included, reducing bounce and complaint rates that hurt your sender reputation.

Mailgun API 550 5.7.1: Step-by-step fix for SPF and DMARC alignment

When Mailgun returns a 550 5.7.1 error due to sender not authorized, it means your domain’s SPF or DMARC policy is misconfigured. Fix it by verifying your SPF record includes include:_spf.mailgun.org, aligns with your sending domain, and that DMARC is set to monitor mode before enforcing. Wait 48 hours after DNS changes, then validate with a tool like MxToolbox and test with a small email batch.

Fix SPF and DMARC configuration step by step

Log in to your DNS provider's dashboard (like Cloudflare, AWS Route 53, or GoDaddy) and locate the TXT record for your sending domain. This record defines who’s allowed to send emails on your behalf.
Add or update your SPF record to include v=spf1 include:_spf.mailgun.org ~all if using your root domain, or include:mailgun.org ~all if using a subdomain. Without this, Mailgun’s servers can’t authenticate your messages.
Check for DNS lookup limits. SPF records must not exceed 10 DNS lookups. If you’re using multiple includes, split the record across multiple TXT records if needed. Too many lookups break SPF validation.
Set up DMARC by creating a TXT record for dmarc._domainkey (or _dmarc.yourdomain.com). Start with p=none to monitor reports and detect issues before enforcing p=quarantine or p=reject. This helps avoid legitimate deliveries being blocked.
Wait 48 hours after saving DNS changes. DNS propagation takes time. Early testing may show errors even if the configuration is correct.
Verify your records resolve using MxToolbox’s SPF and DMARC checker. It will confirm whether your TXT records are correctly published and parsed.
Test deliverability using Mailgun’s API with a small, controlled batch of real email addresses. Check bounce logs for 550 errors and ensure messages land in inboxes, not spam.

Why alignment matters: SPF and DMARC in practice

SPF confirms the sending server is authorized. DMARC enforces alignment between the From: header and the domain in SPF. If either fails, receiving servers reject the email. Even if your SPF is correct, lack of alignment kills deliverability. RFC 7208 defines SPF, and RFC 7483 defines DMARC—both are industry standards for email authentication.

Once you validate both records, reduce future bounces. You can clean and verify your list ahead of sending to prevent such issues at scale. Use our bulk email list cleaning tool to identify risky or invalid addresses before they trigger delivery failures.

What does 'sender not authorized' mean on Mailgun’s side?

When Mailgun returns a 550 5.7.1 "sender not authorized" error, it’s not blocking your email—your message was handed off to the recipient’s mail server, which rejected it during the SMTP handshake. The error comes from the recipient’s own infrastructure, not Mailgun. This means your domain’s authentication setup (SPF, DKIM, DMARC) failed to validate with them, so they refused delivery. The issue isn’t with Mailgun’s routing—it’s with how your domain is configured to send.

Mailgun doesn’t enforce sender policy—it forwards cleanly

Mailgun is strictly an email relay. It doesn’t inspect your domain’s email policies or gate access based on SPF or DMARC. If you send through Mailgun, it forwards your message to the recipient’s MX server exactly as configured. The only decisions Mailgun makes are about routing and basic syntax checks.

Because Mailgun doesn’t perform final validation, you’ll see this error only after your email reaches the receiving mail server. That server checks your sender domain and, if the authentication doesn’t pass, immediately rejects the connection with a 550 reply. You’ve sent the email, but it was blocked at the final step—just like a letter rejected at customs.

The rejection happens during SMTP handshake, not post-delivery

Modern mail servers perform sender validation during the SMTP transaction, typically after the HELO/EHLO and MAIL FROM phases. If the receiver’s server finds that the sending domain doesn’t authorize the IP (via SPF) or fails DMARC alignment, it rejects the message before accepting content. This happens in milliseconds, often before the sender knows anything went wrong.

For example, if your Mailgun IP isn’t listed in your SPF record for your domain, the receiving server sees it as unauthorized and responds with 550 5.7.1. The error has nothing to do with Mailgun’s delivery capability—it’s about domain trust. This is a common outcome when a domain uses a third-party provider (like Mailgun) but hasn’t updated its DNS records.

You can verify your domain’s authentication alignment by checking your SPF and DMARC records using tools like MxToolbox or RFC 7208. If the domain is set to require strict DMARC alignment and Mailgun’s IP isn’t included in SPF, rejection is expected. Fixing this requires updating your DNS records to include Mailgun’s IP ranges or aligning your SPF with your current sending source.

If you're managing large lists of outbound emails, catching these issues early can save you from sudden deliverability blackouts. You can verify your email list’s health before sending with bulk email list cleaning, which identifies invalid, role, or high-risk addresses before they cause authentication issues. This kind of validation helps reduce bounce rates and improves sender reputation.

Why validating email lists before sending reduces 550 5.7.1 errors

You can prevent 550 5.7.1 errors by verifying your email list before sending. Invalid addresses, role accounts, disposable domains, and catch-alls often fail SPF and DMARC checks, trigger bounces, and harm your sender reputation. Cleaning your list upfront ensures only technically valid, properly routed emails get sent, reducing delivery failures and inbox placement issues.

Malformed or invalid addresses create bounce cycles

Even a single malformed email can trigger a bounce cycle. When Mailgun or another ESP receives a message to an invalid address, it often replies with a 550 error—like 550 5.7.1—immediately failing the delivery attempt. If you're sending at scale, repeated bounces from a single bad address can lead to temporary sender blocklists and degrade your overall sender reputation over time.

Let’s be clear: the SPF and DMARC policies you're trying to pass are designed to prevent spoofing. If your sending infrastructure doesn’t validate those domains first, you're sending to addresses that may not be properly authorized. That’s a red flag to gatekeepers like Mailgun and Google. Running your list through a verification tool catches these issues before they impact your deliverability.

Role accounts, throwaway domains, and catch-alls are traps

Role-based emails like admin@, support@, or sales@ are often monitored closely by spam filters. Many of them don’t respond to standard SMTP checks or may be configured as catch-alls, meaning the system accepts any address. This creates false positives: you think the email is valid, but it’s silently discarded or flagged as suspicious.

Disposable email domains—common in lead generation or test sign-ups—rarely pass SPF or DMARC checks. They’re frequently associated with spam traps, even if not explicitly marked. Using a verification tool helps you identify and remove them. Catch-alls are especially problematic: they accept all messages, but deliver nothing. Any email sent to one still counts as a "sent" message, but zero engagement can signal low quality to major providers.

According to RFC 7258, improper handling of malformed or unauthorized domains can lead to delivery failure or blacklisting. The best defense is to prevent those addresses from ever entering your send queue. Tools like bulk email list cleaning or the real-time verification API check for technical validity, role account status, and domain reputation before you send.

Ultimately, a clean list isn’t just more efficient—it prevents you from accidentally undermining your sender reputation. You’re not just reducing bounces; you’re building trust with email gatekeepers. That’s how you keep the 550 5.7.1 error at bay.

How Email List Validation stops 550 5.7.1 errors before they happen

You can’t fix SPF or DMARC issues in Mailgun if you don’t know which addresses are sending from unauthorized domains. Our verification process checks every email against real-time SMTP, domain records, and sender policies—including whether the domain allows Mailgun to send on its behalf—before you send. This catches 550 5.7.1 errors at the source, not after they’ve already hurt deliverability.

How It Works: Real-Time Checks, Not Guesswork

Our real-time verification API tests each email’s syntax, domain existence, and SMTP response—including whether the receiving server accepts Mailgun as a valid sender.
We detect catch-all accounts and role-based addresses (like admin@, support@) that don’t validate as individual inboxes, reducing false positives and bounce rates.
By confirming domain policies via SPF, DKIM, and DMARC records, we flag any mismatch between the sending domain and authorized mail servers—preventing rejection before the email is sent.
A 98.9% accuracy rate means we catch disposable domains, outdated addresses, and poorly configured senders long before they hit your campaign.

Testing Delivered Results, Not Theoreticals

Our inbox placement testing simulates real-world conditions across Gmail, Outlook, and Yahoo, showing how your message lands—not just if it sends.
Instead of relying on blacklists or guesswork, we use real provider behavior patterns, including how they handle mismatched SPF or DMARC policies.
Studies from sources like the Spamhaus Project show that sender policy alignment is one of the top three factors in inbox placement—our tool checks this live.
You're not just cleaning data; you're testing deliverability with the actual infrastructure providers use—giving you measurable confidence.

Let’s be clear: no tool can fix broken SPF or DMARC records in your infrastructure—those require configuration changes. But what we can do is tell you which of your emails are at risk of being blocked by them, before you send. That means fewer bounces, lower spam complaints, and better sender reputation—especially when using third-party services like Mailgun.

How to verify your email list with Email List Validation

Upload your list via our web interface, API, or integrations with Mailchimp, Klaviyo, SendGrid, or HubSpot. Choose real-time or batch validation, then filter out invalid, risky, catch-all, or role-based addresses before sending through Mailgun. This reduces 550 5.7.1 errors and improves your sender reputation.

Upload your list through our web dashboard, API, or sync directly with Mailchimp, Klaviyo, SendGrid, or HubSpot. You can verify up to 100 emails for free to start, and your credits never expire.
Select your validation mode—real-time API for instant checks during signups, or batch processing for large lists. Batch runs are ideal for cleaning existing databases before campaign launches.
Receive detailed verdicts on each email. Valid means deliverable. Invalid means undeliverable. Catch-all indicates a mailbox server accepts any address, but may not be a real user. Risky flags emails with high bounce or spam potential. Role accounts (like admin@ or info@) are typically unengaged.
Filter out problematic addresses before sending. Removing invalids and risky emails reduces bounce rates, avoids blacklisting, and improves inbox placement. This directly mitigates issues like the 550 5.7.1 error caused by sender authorization failures in SPF or DMARC checks.
Test deliverability with our inbox placement reports. These simulate real-world sending across Gmail, Outlook, and other providers to show where your messages land—inbox, spam, or blocked—before you send.

The 5 steps described in “How to verify your email list with Email List Validation”, in order.

Why this prevents 550 5.7.1 errors

The 550 5.7.1 error often appears when Mailgun receives a bounce from a domain that doesn’t authorize your sending IP or domain. This usually stems from weak SPF, DKIM, or DMARC alignment. By cleaning your list ahead of time, you eliminate sends to domains with poor authentication—meaning fewer failures and stronger sender reputation signals.

The combination of real-time verification and post-send inbox testing helps you understand not just which emails are dead, but which domains are likely to treat your messages as spam. According to RFC 7208, SPF is the first line of defense against spoofing. But no system works if you're sending to invalid or poorly authenticated addresses. Validating your list ensures you’re only sending to addresses that can actually receive your messages—and do so securely.

Start with your list, end with results

Let’s say you’ve used an email finder to collect leads. Before adding them to Mailgun, verify them all in a single batch. This reveals invalid entries, catch-alls, and risky role accounts. Remove them. Then test how well the remaining addresses perform in real inboxes. You’ll see fewer bounces, lower spam complaints, and better engagement—directly reducing the chances of hitting a 550 5.7.1 block.

See how it works: clean your entire list in minutes with our bulk verification tool.

Common mistakes when setting up SPF and DMARC with Mailgun

You’re getting Mailgun API 550 5.7.1 sender not authorized errors because your SPF or DMARC setup is misconfigured. The most common culprits are multiple SPF records, overly strict DMARC policies during testing, missing subdomain records for Mailgun, or not checking DMARC reports. These issues break sender authentication and trigger rejection.

Multiple SPF records break authentication

Each domain can have only one SPF TXT record. If you’ve added SPF entries in multiple places — like in your DNS provider’s UI and a third-party email tool — you’re creating multiple records. That’s invalid. Mailgun’s documentation explicitly warns against this, and RFC 7208 confirms only one SPF record is allowed per domain.

Let’s be clear: you can’t just append a new mechanism to a record. Instead, combine all your authorized sources into a single SPF record using the include: syntax. For example, v=spf1 include:mailgun.org ~all covers Mailgun and applies a soft fail. If you're using multiple senders, include them all in one line — not in separate records.

Overly strict DMARC policies hurt testing

Setting Policy=reject (or ~all) too early can silently block legitimate mail from Mailgun during testing. A hard fail (~all) means any email not matching SPF or DKIM gets rejected — even if it's just a misconfiguration, not an attack. Use +all (soft fail) while you validate settings. This lets you observe delivery behavior without breaking it.

Once you confirm authentication is working, move to ~all or all with a monitoring-only policy. The DMARC report is your signal. You’re not trying to block yet — you’re learning. Monitoring reports helps you spot alignment issues and fake senders.

Subdomains need their own SPF records

Mailgun sends from subdomains like mailgun.org or custom domains like mg.yourdomain.com. If your main domain’s SPF doesn’t cover these subdomains, they fail authentication. You must configure SPF records for each subdomain if you use custom domains.

For example, if you’re sending as [email protected], the subdomain mg.yourdomain.com must have its own SPF record allowing Mailgun. Otherwise, the sender fails SPF checks, leading to 550 5.7.1 errors. Check your DNS zone for all subdomains that handle traffic.

DMARC’s value isn’t in blocking — it’s in visibility. Without monitoring, you won’t know if your authentication is broken, or if someone is spoofing you. DMARC reports (RUA) are your primary tool to catch misalignment, missing records, or unauthorized senders.

Most domains get zero DMARC reports at first — not because nothing’s happening, but because no one’s collecting them. Set up a free DMARC report receiver like dmarc.org or use tools that parse reports for you. That insight lets you fix issues before they damage your sender reputation.

Fixing SPF, DMARC, and subdomain alignment isn't just about avoiding 550 errors — it’s about building deliverability. Use bulk email list cleaning to remove invalid addresses before you send, reducing bounce rates and improving reputation.

When to upgrade from SPF-only to full DMARC enforcement

Start with p=none in your DMARC policy to collect reports without blocking legitimate email. After 1–2 weeks of consistent delivery from trusted sources, shift to p=quarantine if reports show minimal false positives. Only move to p=reject once you've confirmed no real senders are impacted. Check aggregate DMARC reports weekly to spot new misconfigurations or impersonation attempts. This phased approach minimizes disruption while securing your domain.

Step-by-step: Gradually tighten DMARC enforcement

Begin with p=none. This logs all authentication results without affecting email delivery. It’s the safest way to see how your current SPF setup performs across all sending sources, including third-party platforms like Mailchimp or your CRM. Use this phase to identify unauthorized senders or missing SPF records. According to the DMARC RFC, this is the standard starting point for enterprises rolling out DMARC.
Review aggregate reports after 1–2 weeks. Log into your email provider’s DMARC reporting dashboard or a third-party tool like Spamhaus or MxToolbox. Look for patterns of failed authentication from known senders. If only a few reports show failures—and none from internal or partner systems—you’re ready to tighten the policy.
Switch to p=quarantine. This marks emails from unverified sources as suspicious, not rejected. Recipients’ filters may still deliver them, but with a warning. This is your safety buffer before enforcing rejections. Monitor inbox placement and bounce rates closely. If delivery to your intended recipients drops, you may have an overlooked sender.
Deploy p=reject only after consistency. Once a full week of testing shows no false negatives and no delivery issues from legitimate sources, move to strict enforcement. This blocks all unauthenticated mail claiming to come from your domain. It’s effective against spoofing and phishing but only safe if your SPF is complete and your sending sources are verified.

Why weekly report checks matter

Even after full enforcement, misconfigurations happen. A new team member might set up a campaign using an unlisted domain. Or a third-party app might start sending from your domain without SPF. Daily monitoring is impractical, but weekly review catches these issues before they trigger Mailgun API 550 5.7.1 errors or damage your sender reputation.

“DMARC is not a one-time setup—it’s a continuous health check on your domain’s integrity.”

For teams using email lists that may include outdated or invalid addresses, verify your sender list first. You can reduce the risk of sending to domains with strict DMARC policies by running a bulk verification beforehand. Use our bulk list cleaning tool to filter invalid and risky addresses before deployment.

Conclusion: Fixing Mailgun 550 5.7.1 is about verification, alignment, and reputation

The 550 5.7.1 error points to your domain’s authentication or sender reputation, not Mailgun’s service. It means receiving servers reject your messages because they don’t trust your sending authorization.

SPF and DMARC records must explicitly include Mailgun to align sender identity with your domain. Misconfigured or missing records cause rejection, even with correct API usage.

Even with correct setup, sending to invalid, role, or disposable emails harms your reputation. Use Email List Validation to clean your list, remove risky addresses, and reduce bounce and spam complaint rates before sending.

Fixing the 550 5.7.1 error requires both technical configuration and ongoing list hygiene. Proper alignment, validated senders, and consistent sending behavior ensure long-term inbox placement.

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does Mailgun 550 5.7.1 mean?

It means the recipient server rejected your email because your domain is not authorized to send from the specified IP. The error originates from the recipient's server, not Mailgun.

How do I fix SPF and DMARC for Mailgun?

Add include:_spf.mailgun.org to your SPF TXT record and set up a DMARC policy (dmarc._domainkey) with p=none initially. Use DNS tools to verify changes.

Why am I getting 550 5.7.1 after changing DNS?

DNS changes take 48 hours to propagate. Ensure your SPF record is correctly formatted and does not exceed 10 DNS lookups.

Can I use Mailgun without SPF and DMARC?

No—most providers reject mail from domains without proper email authentication. SPF and DMARC are required for inbox placement.

How does Email List Validation help prevent 550 5.7.1 errors?

It removes invalid, catch-all, role, and disposable emails before sending—reducing bounces and reputation damage that contribute to sender reputation issues.

What is the difference between SPF, DKIM, and DMARC?

SPF authorizes which servers can send from a domain. DKIM signs emails cryptographically. DMARC defines policies when SPF or DKIM fails—quarantine or reject.

Does Email List Validation work with Mailgun?

Yes. You can integrate it via API or tools like Mailchimp, Klaviyo, and SendGrid to clean your list before sending through Mailgun.

What happens if I don’t fix DMARC?

Your domain may be spoofed, and legitimate mail from your domain could be rejected by major providers like Gmail or Outlook.

Can a list with role accounts cause deliverability issues?

Yes. Role accounts like info@ or support@ are often monitored closely and may be treated as high-risk. Use verification to filter them out.

Do unused email credits expire on Email List Validation?

No. Purchased credits never expire, giving you flexibility for future campaigns.

How can I test if my domain is ready for Mailgun?

Use a tool like MXToolbox to check SPF and DMARC records, then run inbox placement tests with Email List Validation.

What is a catch-all email address?

A catch-all accepts all emails sent to the domain, regardless of the local part. It often fails SPF and is flagged as risky.