sendgrid 550 5.7.1 unable to relay

TL;DR

550 5.7.1 unable to relay almost always means the sending identity is not authenticated or authorized to relay through SendGrid: the from-domain is not authenticated, or you are sending through SMTP with credentials that lack mail-send scope. Authenticate the domain (or at least a single sender) and confirm the sending method's credentials, then retry.

sendgrid 550 5.7.1 unable to relay

Use this when

• SendGrid SMTP or API send bounces with 550 5.7.1 unable to relay
• A new integration fails while an older one on the same account works
• You switched from API key to SMTP credentials and sends broke

Not for this skill when

• The code is 550 5.1.1 or 5.1.10 (recipient unknown; fix the address)
• SendGrid returns 421 (throttled; back off)
• The API returns 400/401/403 (payload or key problem, not relay)

Steps

1. Check which send path you use: SMTP (smtp.sendgrid.net) or Web API v3. Expected: you know which credential type is in play.
2. For SMTP: verify you authenticate with username apikey and the API key as the password, and that the key has Mail Send full access. Expected: auth succeeds; the 5.7.1 clears.
3. For the Web API: confirm the from-address belongs to an authenticated domain or a verified single sender in Settings, Sender Authentication. Expected: the from identity shows Verified.
4. If the domain is unauthenticated, complete domain authentication (SPF + DKIM records at your DNS host) and verify in the dashboard. Expected: domain status becomes authenticated.
5. Resend the failing message unchanged. Expected: accepted (202 via API, 250 via SMTP) instead of the 550 bounce.

Variant phrasings

sendgrid unable to relay 5.7.1 smtp

Use apikey as the SMTP username; a real username with an API key as password fails.

sendgrid 550 relay denied api

The from identity is not authenticated; verify the sender or authenticate the domain.

Tool/version compatibility

SendGrid Web API v3 and SMTP relay (smtp.sendgrid.net:587) as of 2026. Single-sender verification and domain authentication are managed under Settings, Sender Authentication.

Why it happens

A relay server only forwards mail for authenticated, authorized senders. SendGrid's 5.7.1 fires when the credential cannot be tied to mail-send permission (wrong SMTP username, restricted key) or when the from identity is not verified, because SendGrid refuses to relay mail it cannot attribute to an authenticated sender. It is a sender-side authorization failure, not a recipient mailbox problem.

Edge cases / pitfalls

• Keys created with restricted scopes 403 on the API but can surface as 5.7.1 over SMTP; check scope first.
• From-addresses on free email domains (gmail, yahoo) cannot be domain-authenticated; use single-sender verification for those.
• If you rotate keys, update every sender (app, workers, CI); stale keys produce this bounce in the forgotten places.
• Read the key via os.environ.get("SENDGRIDAPIKEY") and never log it.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_lTrRi8FqhdIjaPI6FXYRBA