550 5.7.1 Message rejected by policy (DMARC/SPF/DKIM or blocklist)

What’s actually happening

The recipient's mail server takes the message, then bounces it with a 550 5.7.1. The address is valid — this isn't "no such user" (that's 5.1.1) — the server is rejecting on policy or reputation. The exact wording varies by provider (Google, Outlook, Proofpoint all phrase it differently), and the bounce text usually hints at which: DMARC, SPF, an RBL listing, or a spam-content flag.

Common causes

• SPF, DKIM, or DMARC failed or didn't align to the From: domain, so the receiver treats the mail as spoofed
• The sending IP or domain is on a blocklist (Spamhaus, Barracuda, SORBS) from prior spam or a compromised account
• The message tripped a content/spam policy — link reputation, attachment type, or a spammy payload
• You're sending from a new IP with no warmup history, so reputation is effectively zero
• The specific recipient (or their org) has blocklisted your address or domain

How to fix it

1. Read the enhanced status code and bounce textThe 5.7.1 plus the human-readable line tells you the lane. Mentions of DMARC/SPF mean fix authentication; an IP in brackets with "reputation" means a blocklist or warmup problem; a URL or "spam" reference means content. Don't fix all four blind.
2. Verify SPF, DKIM, and DMARC alignmentSend a test to a Gmail address, open Show original, and confirm SPF=pass, DKIM=pass, and DMARC=pass with alignment. The return-path domain (SPF) and DKIM d= must match your visible From: domain, or DMARC fails even when SPF/DKIM individually pass.
3. Check every blocklist for your sending IPRun the IP through MXToolbox blacklist check or Spamhaus directly. If listed, follow each list's delisting process and fix the root cause first — an open relay, a compromised wp-admin sending spam, or a hijacked SMTP credential — or you'll be relisted within hours.
4. Warm up and authenticate properly for bulk sendingOn a new IP/domain, ramp volume gradually over days, publish SPF + DKIM + DMARC, and set up reverse DNS (PTR) matching your HELO hostname. Use a reputable relay (SES, Postmark, SendGrid) rather than sending bulk straight from a shared host IP.
5. For a single blocking recipient, contact them directlyIf only one domain rejects you and authentication and reputation are clean, their admin has likely blocklisted you. Reach them out-of-band to get the sender allowlisted — no DNS change on your side will override a recipient's local block.