554 5.7.5: “Permanent error evaluating DMARC policy”

Short answer: The receiving server tried to check DMARC for the domain in your From address, hit an error it treats as permanent, and refused the message instead of retrying. In DMARC terms that is a permerror, typically a DMARC record it can't parse. Check _dmarc.yourdomain.com: exactly one TXT record, starting v=DMARC1, with p=none, quarantine or reject.

The bounce looks like this (the wording around it depends on the receiving server)
554 5.7.5 Permanent error evaluating DMARC policy

What it means

No big mailbox provider documents this exact text. Google's list of Gmail SMTP errors (updated 26 October 2026) has no 5.7.5 code, and Microsoft 365 uses 5.7.5 for something else, a certificate that failed MTA-STS validation. So the reply comes from the recipient's own mail server or filter, in its own words. Those words match DMARC's permerror result: "A permanent error occurred during DMARC evaluation, such as encountering a syntactically incorrect DMARC record" (RFC 7489 §11.2; RFC 9989 §9.2 keeps it, with an improperly formatted record as the example). 554 makes it a permanent failure, so your server won't retry, and 5.7.5 is borrowed from RFC 3463, where it means "cryptographic failure". The DMARC standard doesn't tell receivers to reject on an evaluation error: a record without a valid p= should be read as p=none when it has a valid rua= (RFC 9989 §4.10.1), and for errors it can't get past, RFC 9989 suggests a temporary 4xx reply (§7.2). A receiver that answers 554 is being stricter than that, but your record is the part you can fix.

How to fix it

  1. Look up the record the receiver sees: dig +short TXT _dmarc.yourdomain.com (Mac, Linux) or nslookup -type=TXT _dmarc.yourdomain.com (Windows). Use the domain in the From address of the bounced message. Exactly one line should come back.
  2. Two lines starting v=DMARC1? Delete one. RFC 9989 says receivers discard all of them when there is more than one (§4.10), so at best you have no DMARC policy, and a strict receiver treats it as an error.
  3. Check the syntax. v=DMARC1 must be the first tag (RFC 7489 §6.3), tags are separated by semicolons, and p= must be none, quarantine or reject. Common breaks: a curly quote or invisible character pasted from a document or chat, the value wrapped in an extra pair of quotes by the DNS panel, v=DMARC1 not at the start, a misspelled policy, or a report address without mailto:.
  4. In doubt, replace it with a clean record and step up later: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The DMARC generator builds one, and the DMARC checker shows what is published.
  5. Sending from a subdomain (for example mail.yourdomain.com)? Check its _dmarc record too, and the main domain's: receivers fall back to the organizational domain's record when the subdomain has none.
  6. Record clean from several resolvers (your own, 8.8.8.8 and 1.1.1.1) and only one recipient bounces? Then that recipient's server is the problem. Send the full bounce, with the reporting host and the time, to their IT or postmaster address.
  7. If your bounce starts with 4 and says the error is temporary, it is the same check failing on a DNS timeout (DMARC's temperror). Your server retries on its own; make sure your DNS host answers reliably.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Records look right and mail still fails? The free checker reads your DNS. It can't see that your invoicing app, CRM or website form also sends as you, and that is why mail keeps failing after a "perfect" record. I find every service that sends as your domain (a test email from each, plus your DMARC reports), write the exact record for each one with the clicks for your DNS host, and re-check until SPF, DKIM and DMARC pass.

Get it fixed: $29

Pay by card, no account needed. Within 24 hours; not fixed after you follow the steps, full refund. · Do it yourself: Fix Kit ($15)

Who does the work: me, Ashish, the owner of this site, based in India. My public code and tools are on GitHub: github.com/Donrulezz.

Did this fix it?

What's still not working?

Describe what happens and paste any error message. We read every report and fix the page.

Other bounce errors