554 5.7.1 [HM07] — Message rejected due to local policy (iCloud)
Retrying will not help. The message will not be delivered.
The reply
554 5.7.1 [HM07] Message rejected due to local policy.Another of Apple's undocumented policy labels, in the same family as HM08 and CS01. It turns up particularly often on automated relaying and forwarding — replies sent by a worker, a function or a mail gateway rather than by a person's mail client.
What it means
Permanent rejection at the policy stage. The pattern worth knowing about HM07 is that it is frequently reported by people relaying or auto-replying through a platform rather than sending from an ordinary mail server, which is exactly the traffic shape Apple treats with the least patience: mail from an address with no sending history, generated by machine, often without alignment between the envelope and the visible From:.
Why it happens
- Automated replies or forwards emitted by a serverless function, worker or gateway with no established sending identity.
- Forwarded mail carrying no ARC headers — Apple asks for them explicitly on anything forwarded.
- A From: address whose domain does not match what actually authenticated the message.
- The sending domain or IP has no history at Apple.
What to do
- If you are forwarding, add ARC headers. Apple lists this among its requirements and forwarded mail without them loses the original authentication.
- Make the visible From: a domain you control and can authenticate, rather than passing the original sender's address through unchanged.
- Check SPF, DKIM and DMARC alignment on the address that is actually sending.
- Do not retry a 554; it is final for this message.
- If the traffic is legitimate relaying at volume, write to icloudadmin@apple.com describing the flow, with the Txn ID and your sending IPs.
Questions
I only get this on automatic replies. Why?
Automated mail from a platform often sends from an identity with no history, and forwarded or relayed mail loses the original DKIM signature unless ARC preserves it. Both are things Apple weighs heavily.
What are ARC headers?
A chain of signatures that records the authentication result each hop saw, so a receiver can trust a forwarder's word that the message passed before it was relayed. Apple asks for them on forwarded mail by name.