SPF and DKIM Mismatch | Email List Validation

Why does SPF and DKIM mismatch trigger a 550 5.7.15 error in Google Workspace?

You sent a message. It was rejected. The bounce says: 550 5.7.15. You check your logs. You retest. Nothing changes. This isn’t just a glitch—it’s a signal that something foundational is broken.

Google Workspace treats incoming emails like digital passports. It checks two things: who sent the message (SPF) and who signed it (DKIM). If the domains don’t match, the passport is invalid. That’s what the 550 5.7.15 error means: the sender’s identity doesn’t align across both checks.

When your email’s SPF domain doesn’t match the DKIM signature domain—especially in setups using third-party senders, rebranded domains, or misconfigured DNS—you get blocked. No exceptions. Google’s filters treat this as a red flag for spoofing.

Key takeaways

SPF and DKIM must align on domain for messages to pass Google Workspace’s authentication checks.
A mismatch in the From domain between SPF and DKIM triggers a 550 5.7.15 error.
This commonly happens when using third-party email services or misconfiguring DNS records across domains.

How SPF and DKIM alignment works in practice

When Google Workspace returns a 550 5.7.15 error, it’s often because your email failed SPF and DKIM alignment — a technical check that ensures the sending domain in your email’s headers matches the domain authorized to send emails. SPF validates the sending IP against DNS records for the 'return-path' (MAIL FROM) domain, while DKIM signs the message using a private key tied to the 'From' domain. For alignment, these two domains must match or be subdomains with compatible policies. If they don’t align, the email is rejected, even if both records pass individually.

SPF: Checking the envelope sender

SPF checks whether the IP address sending your email is authorized to do so on behalf of the domain listed in the 'envelope from' (also known as the 'return-path' or 'MAIL FROM' address). This is done by querying the DNS records of that domain. If the sending IP isn’t listed in the SPF record, the email fails SPF validation.

Example: If your email claims to come from mail.example.com, you must have an SPF record at example.com allowing the IP address of your mail server. Without that, even a correctly formatted message will be blocked.

DKIM: Signing the message content

DKIM adds a digital signature to your email using a private key registered under the 'From' domain. When the receiver gets the email, they pull the corresponding public key from the domain’s DNS to verify the signature — ensuring the content hasn’t been altered in transit.

What matters here is the domain used in the DKIM-Signature header. That domain must align with the 'From' address in the email or share an organizational relationship with it — especially if you’re using subdomains.

Alignment: The critical link between SPF and DKIM

Google Workspace applies alignment checks to reduce spoofing. It requires that the 'From' domain in the DKIM signature either matches the 'sender' or 'return-path' domain from SPF, or, if a subdomain is used, that the policies are consistent across both records.

For example: If SPF authorizes mail.example.com but DKIM signs with mail.support.example.com, and that subdomain isn’t explicitly covered in SPF or DKIM policies, alignment fails. This is a common misstep with third-party platforms or auto-forwarding services.

According to the IETF’s RFC 7001, alignment is a defined practice in email authentication, and enforcement by major providers like Google is well-documented. Misaligned emails are flagged as suspicious, especially if they come from domains with poor reputation history.

You can test alignment issues before sending by validating your DNS settings with tools like MxToolbox or RFC 7001. If you're unsure whether your sending setup is aligned, use our bulk verification tool to clean lists and validate domain policies at scale.

Common causes of SPF and DKIM mismatches

You're seeing a 550 5.7.15 error in Google Workspace because your email’s SPF and DKIM records don’t agree on who’s allowed to send. This mismatch happens when the sending domain in SPF doesn't match the domain used in the DKIM signature, triggering spam filters. Let’s break down the most common technical missteps behind this.

Transactional email services with mismatched domains

Using SendGrid or Mailgun to send from a domain like yourcompany.com but signing DKIM with a subdomain like mail.yourcompany.com creates a mismatch. The SPF record may allow sending for yourcompany.com, but DKIM signs as mail.yourcompany.com, which fails validation.
Never assume that a third-party service’s default DKIM domain aligns with your SPF-sending domain. Check both the sending domain in DNS and the DKIM selector’s domain.
Google’s own documentation confirms that inconsistent SPF and DKIM alignment is a leading cause of rejection in its filtering system — see their guide on authentication requirements.

Shared infrastructure and migration errors

When sending from a shared IP range (like via a shared email relay), your domain may be listed in SPF, but the DKIM signature uses a different domain. If the DKIM domain isn’t in the SPF record, the message fails alignment.
Migrating from one email provider to another often leaves old SPF records in place. If you keep include:_spf.oldprovider.com but now send from newprovider.com, SPF fails to validate, even if DKIM signs correctly.
Incorrect SPF configurations that include unapproved domains (like a test domain or third-party service) can also cause a mismatch. SPF is strict — it only allows domains explicitly listed in the record. If a sending domain isn’t included, the message gets flagged.
Use a tool like bulk email list verification to test sender domain alignment across your recipient base before send, catching mismatch risks early.

SPF and DKIM are not redundant — they’re complementary. A mismatch between them is like having the right ID and wrong fingerprint: it fails authentication.

Always verify that the domain used in SPF (the sending domain) exactly matches the domain used in DKIM (the d= header). Even small differences — like a subdomain or typo — break alignment. This isn't just a technicality. It directly impacts inbox placement and sender reputation.

How to diagnose SPF and DKIM alignment problems

When sending email from Google Workspace or another platform, a 550 5.7.15 error usually means SPF and DKIM don’t align. Specifically, the domain in the SPF 'From' header doesn’t match the domain in the DKIM signature. This mismatch breaks authentication checks, causing Gmail to reject the message. To fix it, verify that both records align correctly or adjust your policy to allow it.

Check your sending environment first

Run a deliverability test from your mail server or sending platform using a real inbox. Tools like Spamhaus or Google Postmaster Tools can show if alignment is failing and highlight authentication issues.
Use MxToolbox’s DNS check to review SPF, DKIM, and DMARC records. Look for syntax errors, mismatched domains, or missing keys—common causes of alignment failures.
Examine the full headers of a failed email. The SPF check uses the From field, while DKIM uses the From domain in its signature. If they don’t match and no alignment policy is set, the email fails.
If the domains differ, confirm whether your authentication policy explicitly allows such alignment. Without it, even correct records fail in Gmail’s filters.

Fix the alignment problem

Once you confirm the mismatch, correct the root cause. If your SPF record is set to your sending domain but DKIM signs with a third-party domain (e.g., a marketing platform), you’ll need to align the domains or use a policy that allows cross-domain alignment. You can also enforce strict alignment if all senders use the same domain.

For teams using third-party platforms, check whether they’re properly signing with the right domain. For example, if you send through HubSpot or Klaviyo, ensure their DKIM signatures are tied to your verified domain or use a subdomain policy. Misconfigured DKIM or overly restrictive SPF can trigger the 550 5.7.15 error even if all records technically validate.

Real-time email verification can help catch problematic senders early. If you're managing a list of customer or partner emails, verify sender addresses before sending. This reduces the risk of authentication flaws in real-world delivery. See how bulk list verification helps identify invalid or misaligned addresses: clean your list before sending.

Real-world example: A mismatch in a SendGrid-powered campaign

You send emails from yourcompany.com using SendGrid, but Google Workspace rejects them with a 550 5.7.15 error because your DKIM signature is tied to sendgrid.net, not yourcompany.com. Even though SPF allows SendGrid’s IPs, the mismatch between the From domain and the DKIM signing domain violates Gmail’s alignment checks, flagging the message as suspicious. This common misconfiguration breaks authentication and harms deliverability.

How the mismatch breaks authentication

Let’s say you set up SendGrid to send on behalf of yourcompany.com. SPF checks pass because your SPF record includes SendGrid’s IP ranges for yourcompany.com. All seems fine—until DKIM comes into play.

DKIM signs the message with a selector from sendgrid.net. That means the DKIM signature claims authenticity for sendgrid.net, not yourcompany.com. Even though the message says “From: [email protected],” the DKIM domain doesn’t match.

Google’s authentication rules require DMARC alignment: both SPF and DKIM must align with the From domain. When they don’t, Gmail treats the message as potentially spoofed, even if the sender is legitimate. That’s why you receive the 550 5.7.15 error: message rejected due to authentication alignment failure.

Why this happens and how to fix it

This happens when DKIM is set up with a default or incorrect selector domain. Some senders forget to configure DKIM to use their own domain as the signing domain. Others assume that using a provider’s name in the DKIM header is safe—but it’s not.

To fix it, you must generate a DKIM key pair where the domain is set to yourcompany.com, not sendgrid.net. This means updating your DKIM record in DNS to include a selector that aligns with your domain. Once done, the DKIM signature will correctly validate against yourcompany.com, aligning with the From header.

Proper alignment isn’t optional. It’s standard practice. According to RFC 7052 (which outlines email authentication best practices), message integrity and domain alignment are foundational to reputation systems used by major providers like Google and Microsoft.

If you're managing multiple sender domains or use third-party tools, verify your DKIM and SPF records regularly. Tools like MXToolbox or SendGrid’s own authentication checker can help validate setup. But for bulk list hygiene, especially when sending at scale, it's also wise to check if your recipient addresses are still valid and not causing delivery friction. You can test your list’s quality with bulk email list cleaning.

Fixing the alignment issue: Two valid approaches

When Google Workspace returns a 550 5.7.15 error due to an SPF and DKIM mismatch, you're likely sending from a domain that doesn't align with the signing domain in DKIM. The fix is simple: either sign all emails with your own domain (not a third-party provider’s), or configure DKIM to allow relaxed alignment with your sending domain. This ensures both SPF and DKIM validate under the same domain authority, preventing rejection.

Align DKIM signing with your sending domain

Ensure your DKIM signature uses your company’s domain (e.g., d=yourcompany.com), not the provider’s (e.g., d=sendgrid.net).
Configure your email service provider to sign messages with your domain’s private key—this is required for proper alignment with SPF.
Test the DKIM signature using MXToolbox’s DKIM checker to verify the d= tag matches your From domain.

Enable relaxed alignment or use DMARC monitoring

If you can’t change the DKIM signing domain, use a subdomain policy (e.g., mail.yourcompany.com) for SPF and DKIM to ensure both align under your domain hierarchy.
Configure your DKIM selector to reflect your sending domain (e.g., selector1.yourcompany.com) for better alignment with SPF’s include: or all mechanisms.
Set DMARC policy to p=none temporarily to monitor alignment without blocking delivery—check reports at dmarc.org or via tools like Google’s Postmaster Tools to see how often alignment fails.
Use the bulk email list cleaning tool to verify sender domains across your list before sending, reducing the risk of alignment issues caused by stale or misconfigured addresses.

Why verifying sender domain alignment matters before sending

You can have perfect SPF and DKIM records, but if your sending domain doesn’t match the From domain in the email headers, Google Workspace will reject your message with a 550 5.7.15 error. This mismatch trips deliverability even when authentication is technically correct. Preventing this starts not mid-campaign, but before you send—by validating that your domain configuration aligns with every recipient’s domain.

Authentication isn’t enough—alignment is the real test

SPF and DKIM verify that a message came from an authorized server, but they don’t confirm the email’s domain matches the sender’s identity. If your From address says [email protected] but your SPF record only allows send.yourcompany.com, the receiving server sees a conflict. That’s what triggers 550 5.7.15. Even if your technical setup is flawless, misalignment breaks trust.

Google’s email systems enforce this rule strictly. If a message passes SPF and DKIM but fails domain alignment, it's treated as if authentication failed. That’s why you see rejections even with correct DNS records. The fix isn’t just DNS—it’s validating the entire sender-receiver chain before sending.

Check scale—before you scale

Let’s be honest: manually verifying alignment for 10,000 email addresses is impractical. That’s where bulk verification tools come in. You can test your entire list at once and catch mismatched domains before they hit the inbox. Tools like bulk email list cleaning flag domains where authentication is misaligned, catching issues before they cause delivery failure.

Even if your setup is correct, some recipients may use domain aliases, role accounts, or temporary domains—these can break SPF/DKIM alignment unexpectedly. A real-time verification API can catch these cases at send time. It checks both syntax and domain configuration, including alignment signals, before a single message is sent.

For ongoing campaigns, use a tool that tests inbox placement across real mail providers. This confirms not just delivery—but whether your email lands in the inbox, not the spam filter. Inbox placement testing gives you insight on how your domain is perceived across platforms.

Email List Validation helps prevent misaligned outbound emails

You can prevent Google Workspace 550 5.7.15 errors caused by SPF and DKIM mismatches by validating your sending domains before sending. Our API checks DNS records in real time to catch misaligned authentication before emails ever leave your system. This reduces bounces, blocks, and deliverability issues caused by broken email hygiene.

Verify sender domains at scale

Let’s say you’re sending from multiple domains across campaigns. Without verification, it’s easy to overlook that a domain lacks valid SPF or DKIM records entirely. Email List Validation’s real-time API checks these records during bulk processing, flagging domains with missing or incorrect configurations. You’re not just checking email addresses — you’re validating the full envelope of sender authority.

This includes checking if the domain’s SPF record allows the sending IP or mail server, and whether DKIM signatures can be verified by the receiving provider. A mismatch here leads to immediate rejection — especially at Google Workspace, where alignment checking is enforced. The API surfaces these issues before you send, so you can fix them or exclude problematic domains.

Test inbox placement with domain diagnostics

When you run an inbox-placement test, you’re not just seeing if your email lands in the inbox — you’re assessing whether your sender infrastructure meets the standards of providers like Gmail. Our inbox-placement feature includes domain alignment diagnostics: it checks if SPF and DKIM are properly configured, aligned, and authorized across your sending domains.

This helps you understand if your email would be rejected not for content, but due to infrastructure misalignment. For example, if you send from [email protected] but your SPF record doesn't cover the sending server or your DKIM key doesn’t validate, Google will reject the message with a 550 5.7.15 error.

According to the SPF specification, proper alignment between the "envelope from" and "header from" domains is required for successful delivery to major providers. DKIM adds cryptographic validation, but only if the public key is published and correctly linked to the domain. Our service checks both.

Use our inbox-placement test to simulate delivery and get a report detailing alignment issues, DNS errors, and potential blocklist risks. It’s a proactive step that stops problems before they hit your deliverability score.

How to use Email List Validation to ensure deliverability

You can use Email List Validation to catch SPF and DKIM mismatches before they trigger a 550 5.7.15 error in Google Workspace. Run your list through the bulk verification API to flag domains with misaligned authentication. Integrate the real-time API with Mailchimp, SendGrid, or HubSpot to validate addresses before each send. When delivery fails, use the in-app AI assistant to analyze headers and trace misalignment signals.

Bulk verification for domain-level authentication flaws

Upload your list to Email List Validation's bulk verification tool to check for common authentication risks.
Look for domains marked as invalid or risky — these often lack proper SPF, DKIM, or DMARC configuration.
Domains with inconsistent SPF/DKIM records are more likely to be blocked by Google’s reputation systems, leading to hard bounces like 550 5.7.15.
Export flagged domains and cross-check their DNS records using public tools like MXToolbox or RFC 7208 (SPF) and RFC 6376 (DKIM) to verify alignment.

Real-time validation and delivery diagnostics

Integrate the real-time verification API with your email platform (Mailchimp, SendGrid, HubSpot) to catch misconfigured addresses before sending.
Use inbox placement tests at Email List Validation's inbox placement dashboard to validate end-to-end deliverability, including how Google Workspace treats your authenticated messages.
When a send fails, pull the full delivery report and feed it into the in-app AI assistant to parse MIME headers and identify SPF/DKIM misalignment signals.
Let the AI surface mismatches like a domain in the From header not covered by the sender's SPF policy, or a DKIM signature missing for a domain with active DMARC policies.
These signals are a direct cause of 550 5.7.15 — resolving them improves your sender reputation and reduces false positives in filtering systems.

Authentication issues aren’t just technical—they’re reputation risks. A single misaligned SPF or DKIM record can be enough to trigger a 550 5.7.15 error in Google Workspace.

Let’s be clear: no tool can guarantee delivery. But Email List Validation gives you the tools to eliminate the preventable failures. Use it to catch issues early, validate in real time, and diagnose delivery problems with precision.

Final checklist for avoiding 550 5.7.15 errors

550 5.7.15 errors in Google Workspace stem from SPF and DKIM domain mismatches. To prevent them, ensure both authentication methods use the same domain or strictly aligned subdomains, test in real-world conditions, verify your sending platform’s DNS settings, validate every sending domain before sending, and monitor for failed deliveries tied to authentication failures. This isn’t about theory — it’s about configuration consistency.

Core configuration checks

Confirm SPF and DKIM domains match exactly, or are strictly subdomain-aligned (e.g., mail.yourcompany.com for both). A mismatch here triggers Google’s strict alignment policies.
Test your setup with a real inbox placement tool that simulates delivery through Google’s mail servers — don’t rely solely on internal testing or third-party checkers that don’t mirror Gmail’s filters.
Verify that your sending platform's DNS records use the correct domain. Misconfigured platforms can inject SPF records under a different domain than your DKIM selector aligns to, causing silent misalignment.
Always validate every sending domain before sending bulk mail. A single misaligned domain can trigger mass rejections, even with a clean base domain.

Real-world verification and monitoring

Use inbox placement testing to catch 550 5.7.15 errors before they hit your campaign. These tests simulate delivery paths through Gmail’s systems and surface alignment issues early.
Set up logging for delivery failures. When a 550 5.7.15 error appears, trace it back to the SPF/DKIM alignment — Google’s error code is exact, and the source is usually a domain mismatch.
Review your email authentication records quarterly. Changes in email service providers, domain ownership, or DKIM key rotation can silently break alignment.
Reference RFC 7052, which details how DMARC evaluates alignment, and understand that even minor differences — like using www.yourdomain.com in SPF but yourdomain.com in DKIM — can break delivery. The protocol treats these as different identities.

Let’s be clear: SPF and DKIM aren’t optional. They’re required. But they’re only effective if they align. Google uses this alignment to validate sender identity. A mismatch means your message appears forged — even if it isn’t. Use tools like inbox placement testing to catch these issues before your list goes live.

Learn about sender identity alignment in RFC 7052.

Conclusion: Align your authentication, verify your lists, and deliver reliably

The 550 5.7.15 error in Google Workspace signals a fundamental failure in email authentication: SPF and DKIM domains must align. Even if both records are technically correct, a mismatch causes rejection.

Authentication is not a checkbox. It requires alignment between the sending domain in SPF and the DKIM signature domain. Misalignment breaks trust, even with valid credentials.

Prevention begins with validation. Use automated tools to check domain alignment before sending, and verify every email in your list for technical correctness and deliverability risk.

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does 550 5.7.15 mean in Google Workspace?

It means the message was rejected due to authentication failure. Specifically, SPF and DKIM domains do not align, violating Google’s sender reputation policies.

Does SPF or DKIM alone prevent 550 5.7.15 errors?

No. Both must align. A correct SPF record does not guarantee delivery if DKIM uses a different domain.

Can I use a third-party service with a different DKIM domain?

Yes, but you must configure SPF and DKIM domains to align, either by using a shared domain or setting up relaxed policies via DMARC.

How can I test SPF and DKIM alignment before sending?

Use an inbox-placement test or deliverability diagnostic tool. Email List Validation includes domain alignment checks in its verification and testing features.

Is DMARC required to avoid 550 5.7.15 errors?

DMARC is not required, but it enables enforcement of alignment policies. Without DMARC, the error still occurs if authentication alignment fails.

Can disposable or role-based email addresses cause 550 5.7.15?

No. The error is related to sender authentication, not the recipient address. However, role accounts may be blocked by Google Workspace policies.

Does the 550 5.7.15 error affect only Google Workspace?

Primarily Google Workspace, though other email providers may apply similar alignment checks based on RFC 7601.

How accurate is Email List Validation in detecting domain misalignment?

It has 98.9% accuracy in verifying email and domain authentication status, including SPF and DKIM alignment, through real-time DNS checks.

Can I fix misalignment without changing DNS records?

Only temporarily. Persistent fixes require correct DNS configuration for SPF and DKIM. Automated tools like Email List Validation help identify and validate these settings.

How many free verifications does Email List Validation offer?

You get 100 free verifications to start, with purchased credits that never expire.