What does “author-matched” mean?

It means the domain that signed the message (the d= tag) is the same domain as the one in the From address that readers see.

Can the recipient whitelist the platform instead?

Sometimes, but the durable fix is signing with your own domain, which also helps every other receiver that checks DMARC.

5.7.22 bounce: no author-matched DKIM signature

5.7.22No valid author-matched DKIM signature foundPermanent: retrying will not help

Typical wording

550 5.7.22 No valid author-matched DKIM signature found

What it means

RFC 7372 defines X.7.22, “no valid author-matched DKIM signature found”. The message may carry passing signatures, but none of them comes from the domain in the From header (the author domain). Receivers that require author-domain signing, much like DMARC alignment, refuse it.

This is common with third-party senders. A newsletter tool or CRM signs mail as its own domain (d=mailer.example.net) while the From line shows your domain. Verification succeeds, yet the signature says nothing about your domain, so it does not match the author.

It is narrower than 5.7.20 (nothing verified) and different from 5.7.21 (something verified but did not meet local policy). DMARC failures are reported more often with 5.7.26 or provider codes; 5.7.22 is the specific DKIM-only form. A temporary 4.7.22 is allowed by the RFC but uncommon.

Likely causes

A sending platform that signs only with its shared domain and not with yours.
A subdomain signature (d=mail.example.com) checked under strict alignment rules that need the exact From domain.
Forwarding or a mailing list rewriting the message so your own signature broke, leaving only the forwarder’s signature valid.
Custom DKIM set up in the platform but the CNAME or TXT records never published in your DNS.

How to fix it

Check the d= value in the DKIM-Signature header of a sample and compare it with the From domain.
Enable custom-domain DKIM in the sending platform and publish the records it gives you (often CNAMEs such as `s1._domainkey.example.com`).
If you use strict DKIM alignment (adkim=s) in DMARC, sign with the exact From domain, or relax it to relaxed alignment.
Send a test and confirm the Authentication-Results show dkim=pass with header.d equal to your domain.

Checks that apply

Your domain or sending IP (fills in the checks below)

DKIM Check Checks that the selector your platform uses is published under your own domain, which author-matching requires.
DMARC Check Shows your DMARC record and its adkim alignment mode, which decides whether a subdomain signature counts.
Email Header Analyzer Compares the From domain and the DKIM d= domain in a real message, the exact check behind 5.7.22.

FAQ

What does “author-matched” mean?: It means the domain that signed the message (the d= tag) is the same domain as the one in the From address that readers see.
Can the recipient whitelist the platform instead?: Sometimes, but the durable fix is signing with your own domain, which also helps every other receiver that checks DMARC.

All 191 bounce codes