Yahoo refused your message permanently. Yahoo’s own help says this bounce “may be due to” DMARC. The usual case: the message didn’t pass SPF or DKIM for a domain aligned with its From: address, and that domain publishes p=reject. Check whether a sending service (a newsletter tool, CRM, help desk or web server) isn’t set up for your domain, or whether the mail was forwarded, and check your records below.
Last verified 8 October 2026.
Yahoo Help quotes the error as:
554 5.7.9 Message not accepted for policy reasons
and explains it in these words:
If you receive a "554 5.7.9 Message not accepted for policy reasons" delivery error, it may be due to an issue with the sender not using DMARC.
When an email is automatically forwarded from one provider to another, it may appear to come from an unauthorized server if the provider isn't using DMARC.
To check, Yahoo says to open the raw message and look for two things: X-Yahoo-Forwarded, which “means it was forwarded and the line should include the address to which it was forwarded”, and p=reject, which “means the original domain is using DMARC and per their instructions, the email is being rejected.”
What the two checks point to: the From: domain asks receivers to reject mail that fails DMARC (RFC 7489 §6.3: “reject: The Domain Owner wishes for Mail Receivers to reject email that fails the DMARC mechanism check.”), and this message failed. Yahoo’s FAQ says the same of its own filtering: “If a domain is protected by DMARC with ‘p=reject’, any message without a proper DKIM signature or SPF alignment will be rejected by Yahoo's mail servers.” Failing DMARC doesn’t mean SPF or DKIM failed: they may have passed for the sending service’s domain, which doesn’t count for yours. That is DMARC alignment.
Sources: Yahoo Help, “554 5.7.9 Message not accepted for policy reasons” delivery error; Yahoo Sender Hub, FAQs; RFC 7489 §6.3 (checked 8 October 2026). Yahoo’s Sender Hub doesn’t list the full text of each code, and a real bounce can carry more after the text above.
Yahoo’s SMTP error codes page groups its errors by cause rather than listing every code. For the 5xx (553 and 554) permanent errors it gives these reasons, among others:
On authentication it says: “All senders need to authenticate their emails with either SPF or DKIM. Bulk senders must authenticate with SPF and DKIM, and have a DMARC policy in place”. Yahoo treats 5xx errors as permanent and says not to retry them; a 4xx (421 or 451) is temporary, and Yahoo says you may retry later.
| Authentication failure (553/554) | DMARC or DKIM failed against the sending domain’s policy: this page. |
|---|---|
| “Content based blocks (e.g: PH* Errors)” | Something in the content: Yahoo lists viruses, phishing, ransomware, other malicious software and links to them. Not a DNS problem. |
| “Message temporarily deferred (eg: TS* Errors)” | Temporary: complaints, spam-like content, a poor IP reputation or unusual traffic. Your server usually retries. |
| “Unresolvable RFC.5321 or RFC.5322 from domain” | The Return-Path or From: domain doesn’t appear to be valid. Yahoo: “These errors can be returned as either a timeout/servfail (451) or a permfail (554)”. |
| 4xx authentication | “Authentication results for your domain could not be determined due to a temporary error.” Retry; if it keeps happening, check that your DNS answers reliably (see SPF TempError). |
Source: Yahoo Sender Hub, SMTP Error Codes (checked 8 October 2026). Quoted headings in the left column are Yahoo’s.
Enter your From: domain. The check runs in your browser against public DNS: it reads the SPF record, how it ends (-all or ~all), follows its includes to count DNS lookups and find a PermError, and reads the DMARC policy that applies.
DNS shows what your domain allows, not what happened to one message: this can’t see which IP sent the bounced mail, whether its DKIM signature verified, or whether it was forwarded. The message headers show that.
What this can and can’t tell you: it reads DNS right now through Cloudflare’s public resolver (Google’s when Cloudflare’s fails). A lookup that fails is reported as unknown, never as a missing record. DKIM isn’t checked, because a DKIM key is published at a selector named only in the message’s DKIM-Signature header; check one with the DKIM key check. For the full A–F grade with DKIM selectors, MTA-STS and more, use the DMARC checker.
Yahoo’s Sender Requirements & Recommendations, enforced from February 2024 (one-click unsubscribe from June 2024):
Yahoo doesn’t set a number for “bulk”: its FAQ says “A ‘bulk’ sender is classified as an email sender sending a significant volume of mail. We will not specify a volume threshold.” On what happens otherwise: “If you do not meet the requirements, your mail may be sent to the spam folder or rejected.” The requirements “apply for all domains and consumer email brands hosted by Yahoo Mail”, which is how the FAQ answers whether they apply to AOL. The full list, with Gmail’s and Microsoft’s, is in bulk sender requirements.
Sources: Yahoo Sender Hub, Sender Requirements & Recommendations and FAQs (checked 8 October 2026).
p=rejectThis is the case Yahoo’s help describes. Run the check above: if the DMARC policy row shows p=reject (or p=quarantine), any mail From: your domain that doesn’t pass DMARC can be refused or sent to spam. To pass, RFC 7489 §4.2: “A message satisfies the DMARC checks if at least one of the supported authentication mechanisms: 1. produces a “pass” result, and 2. produces that result based on an identifier that is in alignment”. Causes 2 to 4 are the usual reasons it didn’t.
If the bounced mail wasn’t From: your domain (you’re a forwarder or a list), the policy that applies is the original sender’s: see cause 4.
Many services sign every message with their own domain (d=service.example) and use their own Return-Path until you add your domain in their settings. Their SPF and DKIM pass, but not for a domain aligned with your From:, so DMARC fails. RFC 7489 §3.1.1: “merely bearing a valid signature is not enough to infer authenticity of the Author Domain.” Yahoo’s requirements make the alignment explicit: the From: domain must be “aligned with either the SPF domain or the DKIM domain”.
Fix: in the service’s domain or sender authentication settings, add your domain and publish the DKIM records it gives you (usually CNAMEs or a TXT record at <selector>._domainkey.yourdomain.com), and a custom Return-Path on your domain if it offers one. Yahoo requires a DKIM key of 1024 bits or more and recommends 2048. See DMARC alignment failed for the alignment rules.
You added a newsletter tool, CRM, help desk, invoicing app or a web server’s contact form, and it sends as your domain from its own servers. Yahoo sees an IP your record doesn’t list, and its FAQ says SPF records “allow Yahoo to reject messages which originate from IPs not listed in the domain's SPF record.” Without an aligned DKIM pass, the message then fails DMARC too.
Fix: add the service’s include: (from its setup guide) to your one SPF record, for example v=spf1 include:_spf.example.net include:sendservice.example ~all. Never publish a second SPF record: two records are a PermError (merge them). Stay at 10 DNS lookups or fewer (SPF too many DNS lookups), or SPF returns a PermError and passes nothing.
A forwarder delivers from its own IP, which isn’t in the original sender’s SPF record, and a list that edits the subject or adds a footer breaks DKIM. RFC 7489 §10.5: “Transiting a Mediator often causes either the authentication to fail or Identifier Alignment to be lost.” If the original From: domain publishes p=reject, Yahoo then refuses the forwarded copy; Yahoo’s help says X-Yahoo-Forwarded in the raw message means it was forwarded.
Fix: sign all your mail with DKIM on your own domain, so it still passes after a forward that doesn’t change it. If you run the forwarder, Yahoo says: “If you forward emails, implement ARC (Authenticated Received Chain).” If you run a list, Yahoo’s advice is:
For mailing lists, also known as “listservs,” you should change your sending behavior by adding the mailing lists' address to the “From:” line, rather than the sender's address. Also, enter the actual user/sender address into the “Reply-To:” line.
If SPF, DKIM and DMARC all pass and aligned, check the rest of the list above: a working one-click List-Unsubscribe header (RFC 8058, with List-Unsubscribe-Post: List-Unsubscribe=One-Click) on marketing mail, a spam rate below 0.3%, and valid forward and reverse DNS for your sending IPs. None of these is visible from your domain’s DNS.
554 is also used when the message itself is the problem: Yahoo’s error page lists “The message contains characteristics that Yahoo won't accept for policy reasons”, and under “Other policy errors (e.g. 550, 554)” gives examples such as “A null MX record”, “Header too big (e.g. From, Subject, To)” and “Date outside of range”. If authentication passes in the raw message, look at the content and headers of the mail that bounced.
Sources: Yahoo Sender Hub, Sender Requirements & Recommendations, FAQs and SMTP Error Codes; Yahoo Help, 554 5.7.9 delivery error; RFC 7489 §3.1.1, §4.2, §10.5; RFC 8058 (checked 8 October 2026).
whois on the IP) usually tells you: your mail provider, a marketing tool, your web host, or a forwarder.include: to your one SPF record and stay at 10 lookups or fewer.Gmail refuses the same failures with a different code; see Gmail 550 5.7.26. Outlook.com uses 550 5.7.509 for a DMARC reject.
Send a message the same way the bounced one went (same service, same From: address) to a Yahoo Mail address you can open. Yahoo’s help article on full headers (written for the older desktop version of Yahoo Mail) says: “Click on an email to open it.” then click the More icon and “select View Raw Message.” Yahoo notes that article is for the older version, so the label may differ in yours.
In the raw message, find the Authentication-Results header, the standard place (RFC 8601) where a receiving server records its SPF, DKIM and DMARC results. A passing message has entries like these:
Authentication-Results: receiver.example;
dkim=pass header.i=@example.com header.s=s1;
spf=pass smtp.mailfrom=bounces@example.com;
dmarc=pass(p=REJECT) header.from=example.comdkim=pass with header.i or header.d on your domain: an aligned DKIM signature. If it shows the service’s domain instead, DKIM isn’t set up with yours (cause 2).spf=pass with smtp.mailfrom on your domain: an aligned SPF pass. softfail or fail means the sending IP isn’t in that domain’s record (cause 3); permerror, see SPF PermError.dmarc=pass: at least one of the two passed and aligned. That is what stops the DMARC case of 554 5.7.9.Sources: Yahoo Help, Find delivery delays and identify sender in Yahoo Mail; RFC 8601 (checked 8 October 2026). The header above is an illustration with documentation names; each receiver formats it a little differently.
Not until you’ve fixed the cause. Yahoo treats 553 and 554 errors as permanent and says not to retry a message that comes back with a 5xx error. Find which check failed, fix the sending service or your records, send a test, then resend.
Every sender needs SPF or DKIM at a minimum. Bulk senders need both SPF and DKIM, a DMARC record of at least p=none that passes, and a From: domain aligned with the SPF or the DKIM domain. Yahoo doesn’t publish a volume threshold for bulk senders.
A forwarding server delivers from its own IP, which isn’t in the original sender’s SPF record, so SPF fails. If the forward also lost a passing aligned DKIM signature and the original From: domain publishes p=reject, the message fails DMARC and Yahoo refuses it. Yahoo’s help says to look for X-Yahoo-Forwarded and p=reject in the raw message, and Yahoo recommends ARC to anyone who forwards mail.
The sender requirements do: Yahoo says they apply to all domains and consumer email brands hosted by Yahoo Mail, in answer to a question about AOL. Yahoo says Yahoo Japan is a separate company and it can’t speak for its plans.
No. Yahoo requires a DMARC record from bulk senders, and removing it drops the policy that tells receivers to reject mail forging your domain. If valid mail fails DMARC at p=reject, you can lower the policy to p=none while you fix the sending service, then raise it again once that service passes with an aligned SPF or DKIM domain.
If you manage domains for clients or brands, Email Security Signals checks a whole list and returns one row per domain with SPF (lookup count included), DMARC, DKIM across 57 common selectors plus any you add, and an A–F grade. $0.02 per graded domain ($20 per 1,000); invalid inputs, domains that don’t exist, DNS lookup failures and duplicates are free.
Check a list on the Apify Store →Related: Gmail 550 5.7.26, Outlook 550 5.7.509, DMARC alignment failed, moving DMARC from none to reject, bulk sender requirements and the free DMARC, SPF and DKIM checker.