554 5.7.1 [HME1] — authentication failed (iCloud)
Retrying will not help. The message will not be delivered.
The reply
554 5.7.1 [HME1] Message rejected due to local policy.The one code in this family with a concrete, fixable meaning: the message authenticated as nobody. Both SPF and DKIM failed, so iCloud has no evidence the sender is who the From: header claims. This is entirely yours to fix and it is usually a DNS mistake.
What it means
SPF checks whether the sending IP is authorised by the envelope sender's domain; DKIM checks a signature over the message against a key in the sending domain's DNS. Passing either is normally enough. Failing both means nothing connects the message to the domain it claims to come from, which is indistinguishable from forgery. Unlike the policy labels this one does not need Apple's cooperation — publish the records correctly and it stops.
Why it happens
- No SPF record on the sending domain, or one that does not list the server actually sending.
- The envelope sender is a different domain from the one whose SPF record you fixed.
- DKIM not configured, or the public key missing from DNS at the selector the signature names.
- An SPF record over the ten-DNS-lookup limit, which fails as permerror — the record can look perfect and still fail everywhere.
- Two v=spf1 records on one name, which is a permanent error rather than a merge.
- A DKIM signature broken in transit by a mailing list or gateway that modified the message.
What to do
- Publish an SPF record listing every server that sends for the domain, and keep it under ten DNS lookups.
- Set up DKIM signing and confirm the public key resolves at selector._domainkey.yourdomain.
- Make sure the domain being authenticated is the one in the visible From: header, not just the envelope.
- Check both from outside your own network — a record that has not propagated behaves exactly like a missing one.
- Add a DMARC policy once SPF and DKIM pass, and read the reports it brings back.
Questions
SPF is published. Why does it still fail?
Three usual reasons: the envelope sender is a different domain from the one you fixed, the record exceeds ten DNS lookups and returns permerror, or there are two v=spf1 records on the name, which is an error rather than a union.
Is DKIM alone enough?
For this code, yes — a passing DKIM signature satisfies it. DKIM is also the more robust of the two, because it survives forwarding where SPF does not.