SMTP error 5.7.22 No valid author-matched DKIM signature found

What SMTP error 5.7.22 means

Everything about the signature is sound except whose it is. The message carries a DKIM signature that verifies perfectly, but the domain in its d= tag is not the domain in the From header, so the receiver has no proof that the author domain vouched for the message. Arriving as 550 5.7.22, this is the signature you get when a third-party platform sends on your behalf using its own key rather than yours.

Security or policy status
Sent by The receiving mail server, comparing the signing domain against the From address
Occasional

What SMTP error 5.7.22 No valid author-matched DKIM signature found actually means

The registry describes this as a special case of 5.7.21: the signature would be acceptable on every other measure and is refused solely because it is not author-matched. A verifying signature from a bulk platform on a message From accounts at your company proves that the platform sent it, which is true and is not the question the receiver asked. It wants evidence that your domain sent it. That is the same idea as DMARC alignment, and the remedy is the same: get the platform signing as you. Registered as permanent only, so the message bounces rather than waiting.

This status code is returned when a message contains one or more passing DKIM signatures, but none are acceptable because none have an identifier(s) that matches the author address(es) found in the From header field. This is a special case of X.7.21. (This violates the advice of Section 6.1 of [RFC6376].)
— RFC 7372 with RFC 6376

How 5.7.22 appears in a bounce

A server reporting this condition sends it alongside a three-digit reply code, and a bounce prints the two together. The registry lists 550 5.7.22 as the pairing for this status.

The leading 5 is the server's verdict rather than part of the code's identity: it marks this as a permanent failure, which means the sending server has given up and returned the message.

What causes SMTP error 5.7.22 on a business phone system

A platform signing with its own default domainMarketing, e-commerce and accounting platforms ship with a shared signing domain so mail works on day one. It authenticates for them, and until you complete branded signing it can never align with your From address.
A Microsoft 365 tenant still signing as onmicrosoft.comWhere custom-domain DKIM has never been enabled, outbound mail carries a signature for the tenant's onmicrosoft.com name. It verifies faultlessly, which is why people insist DKIM is working, and it is not the author domain.
Branded CNAMEs published but never activatedNearly every platform makes this two steps: create the DNS records, then return to the console and switch signing on. Businesses regularly complete the first, see the records resolving, and assume they are finished.
A subdomain signature against strict alignmentA signature for a sending subdomain satisfies relaxed alignment but not strict. If the domain publishes adkim=s, only an exact match to the From domain counts, and a perfectly legitimate subdomain signature is discarded.
An outbound gateway re-signing with its own identitySome hosted security services sign departing mail under a shared service domain. Where that becomes the only surviving signature, no author-matched signature remains for the receiver to find.

How to fix SMTP error 5.7.22

Compare d= with the From domain on one real messageOpen the headers of something you actually sent through the platform in question and read the two values side by side. If they differ, you have both diagnosed and scoped the problem in a single glance.
Enable custom-domain DKIM on your mail tenantIn Microsoft 365 that means publishing the two selector CNAMEs for the domain and then turning signing on in the portal. Until the second half is done the tenant keeps signing under its onmicrosoft.com name.
Set up branded signing at every third-party senderWork the list one platform at a time: publish the CNAME the platform gives you, activate signing, then send a test and confirm d= now shows your domain. Budget ten minutes each and do them in one sitting.
Give unco-operative platforms a subdomainWhere a supplier genuinely cannot sign as your domain, have it send From a subdomain it can sign for. With relaxed alignment that still satisfies the author-match test at the organisational level.
Check the alignment mode you are asking forIf your DMARC record specifies adkim=s, confirm every sender produces an exact-match signature before leaving it there. Relaxed mode is the sensible default for a business using several sending platforms.

Fixing the underlying problem

This page explains the code. These guides walk through the fix in detail.

Questions about SMTP error 5.7.22

Our mail is definitely signed. Why is it being refused?

The question is not whether it is signed but who signed it. A signature belonging to your CRM or your mail tenant's default domain verifies correctly and still tells the receiver nothing about your domain. Read the d= tag and see whose name is on it.

Can a message carry more than one DKIM signature?

Yes, and it is completely normal when a gateway adds its own on the way out. Only one of them needs to be author-matched for this rejection to stop, so adding your own signature does not require removing anybody else's.

Does this affect email between our own staff?

No. Messages between mailboxes inside the same tenant are delivered internally and never cross an external SMTP check, which is why internal testing gives a clean bill of health while customers are still bouncing. Always test to an outside address.

How is this different from 5.7.21?

They overlap, and 5.7.22 is the narrower one. Both mean a signature verified and was not accepted, but 5.7.22 states the specific reason: no signature matched the author domain in the From header. A bare 5.7.21 means the receiver rejected it on some other quality, such as key strength.

Related SMTP status codes

Source. SMTP error 5.7.22 No valid author-matched DKIM signature found is defined in RFC 7372 with RFC 6376 and registered in the IANA SMTP Enhanced Status Codes registry. The causes and fixes above are drawn from our own experience supporting UK business email systems.

All Email delivery & SMTP codes