Have you ever tried sending an email only to receive a bounce-back message such as:
554 – 5.7.5 Permanent error evaluating DMARC policy
This error can prevent emails from being delivered to external organizations, even though your email account is working normally.
Recently, we encountered this type of issue where emails sent through Zoho Mail to recipients at an external organization were repeatedly rejected by the recipient’s mail server.
The solution involves checking the domain’s SPF, DKIM and DMARC configuration, as well as the DNS records associated with the sending domain.
What Does the 554 5.7.5 DMARC Error Mean?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance.
It is an email authentication standard that helps receiving mail servers determine whether an email was legitimately sent on behalf of the domain shown in the sender’s address.
DMARC relies primarily on two authentication mechanisms:
- SPF – Sender Policy Framework
- DKIM – DomainKeys Identified Mail
For DMARC to pass, at least one of these authentication mechanisms needs to successfully authenticate and align with the domain in the visible From: address.
When a receiving server cannot properly evaluate the sender’s DMARC status, it may reject the message.
Understanding the Error
A typical bounce-back may look like this:
ERROR CODE : 554 - 5.7.5 Permanent error evaluating DMARC policyYou may also see information such as:
Remote-MTA: dns; mxb-0035d101.gslb.pphosted.com
Diagnostic-Code: 5.7.5 Permanent error evaluating DMARC policyThis tells us that the recipient’s mail infrastructure rejected the message during its DMARC evaluation.
Importantly, this does not necessarily mean that the recipient’s email address is incorrect.
The problem is related to email authentication and DNS.
Why Does This Error Happen?
There are several possible causes.
1. Incorrect SPF Record
SPF identifies the servers that are authorized to send email for your domain.
If your organization uses Zoho Mail but the domain’s SPF record does not authorize Zoho’s mail servers, SPF authentication can fail.
For example, an incorrectly configured SPF record could cause the receiving server to question whether the message was legitimately sent by your domain.
Zoho recommends configuring an SPF record for domains using Zoho Mail.
2. DKIM Is Missing or Incorrect
DKIM adds a cryptographic signature to outgoing emails.
The sending mail server signs the message using a private key, while the receiving server retrieves the corresponding public key from DNS to verify the signature.
If the DKIM record is missing, incorrect or does not correspond to the signing configuration, DKIM authentication may fail.
3. Incorrect DMARC Record
DMARC is published as a TXT record in DNS, normally using:
_dmarc.yourdomain.comThe record tells receiving mail servers what to do when an email fails DMARC authentication.
For example:
v=DMARC1; p=none;A domain may also use policies such as:
p=quarantineor:
p=rejectA reject policy is more restrictive and can result in messages being rejected when authentication requirements are not met.
4. Multiple DMARC Records
One particularly important issue is having more than one DMARC TXT record for the same domain.
For example:
_dmarc.example.comshould not have multiple independent DMARC records.
Zoho specifically notes that multiple DMARC records on the same domain can cause DMARC processing to fail with a permanent error.
This is therefore one of the first things an IT administrator should check when encountering a 554 5.7.5 Permanent error evaluating DMARC policy.
How to Troubleshoot the Problem
Step 1: Check Your SPF Record
Log in to your domain’s DNS management panel.
Look for a TXT record containing:
v=spf1If you are using Zoho Mail, ensure that your SPF configuration follows the values provided by Zoho for your particular domain and setup.
Do not simply add another SPF record if one already exists.
A domain should have a properly consolidated SPF policy rather than several competing SPF records.
Step 2: Check DKIM in Zoho Mail
Log in to the Zoho Mail Admin Console.
Go to your domain’s email configuration and locate DKIM.
Zoho provides a selector and the corresponding public key that needs to be published as a TXT record in your DNS. After publishing it, verify the selector and enable DKIM in Zoho Mail.
The DNS record will normally look similar to:
zoho._domainkey.yourdomain.comThe exact selector and value should come from your Zoho Mail administration console.
Step 3: Check the DMARC Record
Look for:
_dmarc.yourdomain.comThere should be one valid DMARC record.
A monitoring configuration may look similar to:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comThe exact DMARC policy should be determined based on your organization’s email infrastructure and authentication results.
Do not immediately change your policy to p=reject simply because you want stronger security. First make sure legitimate email sources are correctly authenticated.
Step 4: Verify SPF and DKIM Alignment
DMARC is not simply a matter of SPF or DKIM existing.
The authenticated domain also needs to be appropriately aligned with the domain in the From address.
For example, if the user sends:
From: user@company.co.kethe SPF/DKIM authentication needs to provide an aligned identity for company.co.ke under the DMARC alignment rules.
DMARC supports both relaxed and strict alignment.
Step 5: Check Third-Party Email Services
Many businesses use additional platforms to send email, such as:
- Website contact forms
- CRM systems
- Marketing platforms
- Newsletter services
- Accounting systems
- Helpdesk systems
- Microsoft 365
- Google Workspace
- ERP systems
- Bulk email platforms
If these services send email using your domain, they must be properly authenticated.
Zoho notes that third-party services sending mail on behalf of your domain can appear unauthenticated and may be rejected depending on your DMARC policy.
Therefore, don’t configure SPF, DKIM and DMARC based only on Zoho if other systems are also sending email.
What If Email Works to Gmail but Fails to Another Company?
This is an important clue.
If your emails are successfully delivered to Gmail, Outlook or other providers but consistently fail when sending to one particular organization, the problem may involve the recipient’s mail security infrastructure or its interaction with your domain’s authentication records.
In the example above, the remote mail server reported:
554 - 5.7.5 Permanent error evaluating DMARC policyThe recipient organization was using a Proofpoint-hosted mail gateway.
This means troubleshooting should involve checking both sides:
Sender side
- SPF
- DKIM
- DMARC
- DNS
- Email routing
- Third-party senders
Recipient side
- DMARC processing
- Proofpoint/mail gateway configuration
- Sender reputation
- Recipient security policies
- DNS resolution
If the sender’s authentication records are correct and the rejection continues, the recipient’s IT or email security administrator may need to investigate the rejection.
Don’t Disable DMARC Without Understanding the Cause
A common reaction to email delivery problems is to remove DMARC or make the policy less restrictive.
This isn’t always the right solution.
DMARC is an important security control against domain spoofing and phishing.
Instead, identify why authentication is failing first.
A safer troubleshooting approach is:
SPF → DKIM → DMARC → Alignment → Third-party senders → Recipient mail gateway
Once legitimate email sources are authenticated correctly, the organization can determine an appropriate DMARC enforcement policy.
How Etuu Technologies Can Help
Email problems can be difficult to diagnose because they involve multiple systems: DNS, email hosting, authentication records, mail servers and recipient security gateways.
Etuu Technologies provides professional email and ICT support for businesses in Kenya, including:
- Zoho Mail configuration
- SPF configuration
- DKIM configuration
- DMARC implementation
- Email troubleshooting
- DNS management
- Microsoft 365 support
- Google Workspace support
- Email migration
- Email security
- Managed IT Services
- Cybersecurity support
If your business is experiencing email delivery failures, bounced emails, spam problems or authentication errors, our IT team can investigate the underlying configuration and help restore reliable email communication.
Experiencing Email Delivery Problems?
Don’t ignore repeated bounce-back messages.
A properly configured email authentication system helps improve email security, reduce spoofing and improve the reliability of business communication.
Contact Etuu Technologies for professional email configuration, cybersecurity and Managed IT Services in Kenya.
Etuu Technologies – Customer support is in our DNA.
