Skip to main content
mailyoto
7 of 13

Email refused because of DKIM

When Mailyoto refuses forwarded email that lacks a valid DKIM signature, when it delivers it from a reply address instead, and what the sender changes to fix it.

Updated 27 October 2026

A sender’s email to your alias bounced, and the bounce holds this response from Mailyoto:

550 5.7.1 Delivery refused: the destination mailbox provider requires DMARC-aligned mail and this message is not aligned.

Your logs show the message as Failed for that destination.

Why it happens#

A forwarded email can’t pass SPF for the original sender, because it now comes from Mailyoto’s servers. DMARC then passes only when the message carries a valid DKIM signature from the sender’s own domain, the domain in its From address.

Some mailbox providers refuse forwarded email that fails that test:

  • a destination hosted by Yahoo, when the message has no valid DKIM signature from the sender’s domain
  • a destination hosted by Microsoft or Apple, when the sender’s domain also has a DMARC policy of p=reject

When SPF passed for the sender’s domain on its way to Mailyoto, the message still reaches those destinations. Mailyoto delivers it from a reply address that its own signature covers. The copy then passes DMARC there:

From: "Diego Ramos (diego at tasteofmira.shop)" <…@reply.yotosend.com>
X-Original-From: Diego Ramos <diego@tasteofmira.shop>

Pressing Reply then sends your response through the alias when Reply from your alias is on, and directly to the sender when it’s off.

Mailyoto refuses the message for those destinations only when nothing proves the sender: SPF fails for the sender’s domain, or a rule forwarded the message rather than an alias. The sender then learns at once, not through a later bounce. Other destinations of the same alias still get the message.

A signature that fails on its own doesn’t stop a message to any other destination. Mailyoto records the result in the message’s Authentication-Results header and forwards it.

Fix it#

The signature belongs to the sender, and the sender fixes it. Send them this list.

  1. Sign with the From domain#

    The sender’s email provider must sign each message with a DKIM key for the domain in the From address. A signature from the provider’s own domain doesn’t count for DMARC.

  2. Publish the key#

    The DKIM record the provider asks for must exist in the sender’s DNS, with the exact name and value the provider gives.

  3. Leave the message unchanged after signing#

    A footer, a rewritten link or a changed subject added after signing breaks the signature. Mailing list software and some security gateways do this.

  4. Send the email again#

    Once the sender’s own test shows dkim=pass for their domain, they send the message again.

Confirm it worked#

Open Logs and search for the sender’s address. The new message shows Delivered for every destination.

The sender can't change their setup

Point the alias at a destination with another mailbox provider as well. Mailyoto forwards to that one even when it refuses the Yahoo, Microsoft or Apple destination.