## TL;DR
550 5.7.1 unable to relay almost always means the sending identity is not authenticated or authorized to relay through SendGrid: the from-domain is not authenticated, or you are sending through SMTP with credentials that lack mail-send scope. Authenticate the domain (or at least a single sender) and confirm the sending method's credentials, then retry.

```text
sendgrid 550 5.7.1 unable to relay
```

## Use this when
- SendGrid SMTP or API send bounces with 550 5.7.1 unable to relay
- A new integration fails while an older one on the same account works
- You switched from API key to SMTP credentials and sends broke

## Not for this skill when
- The code is 550 5.1.1 or 5.1.10 (recipient unknown; fix the address)
- SendGrid returns 421 (throttled; back off)
- The API returns 400/401/403 (payload or key problem, not relay)

## Steps
1. Check which send path you use: SMTP (smtp.sendgrid.net) or Web API v3. Expected: you know which credential type is in play.
2. For SMTP: verify you authenticate with username apikey and the API key as the password, and that the key has Mail Send full access. Expected: auth succeeds; the 5.7.1 clears.
3. For the Web API: confirm the from-address belongs to an authenticated domain or a verified single sender in Settings, Sender Authentication. Expected: the from identity shows Verified.
4. If the domain is unauthenticated, complete domain authentication (SPF + DKIM records at your DNS host) and verify in the dashboard. Expected: domain status becomes authenticated.
5. Resend the failing message unchanged. Expected: accepted (202 via API, 250 via SMTP) instead of the 550 bounce.

## Variant phrasings
### sendgrid unable to relay 5.7.1 smtp
Use apikey as the SMTP username; a real username with an API key as password fails.
### sendgrid 550 relay denied api
The from identity is not authenticated; verify the sender or authenticate the domain.

## Tool/version compatibility
SendGrid Web API v3 and SMTP relay (smtp.sendgrid.net:587) as of 2026. Single-sender verification and domain authentication are managed under Settings, Sender Authentication.

## Why it happens
A relay server only forwards mail for authenticated, authorized senders. SendGrid's 5.7.1 fires when the credential cannot be tied to mail-send permission (wrong SMTP username, restricted key) or when the from identity is not verified, because SendGrid refuses to relay mail it cannot attribute to an authenticated sender. It is a sender-side authorization failure, not a recipient mailbox problem.

## Edge cases / pitfalls
- Keys created with restricted scopes 403 on the API but can surface as 5.7.1 over SMTP; check scope first.
- From-addresses on free email domains (gmail, yahoo) cannot be domain-authenticated; use single-sender verification for those.
- If you rotate keys, update every sender (app, workers, CI); stale keys produce this bounce in the forgotten places.
- Read the key via os.environ.get("SENDGRID_API_KEY") and never log it.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_lTrRi8FqhdIjaPI6FXYRBA