What does “421 4.7.30 Your email has been rate limited because DKIM authentication didn't pass for this message” mean?

What does it mean?

DKIM is a signature on each message, checked against a key in your DNS. Here the signature was missing, or the key was not found, or the message changed after it was signed.

What exactly does the source say?

421 4.7.30 Your email has been rate limited because DKIM authentication didn't pass for this message. Gmail requires all email bulk senders to authenticate their email with DKIM. Authentication results: DKIM = Did not pass. To set up DKIM for your sending domains, visit Set up DKIM. To learn more about Gmail requirements for bulk email senders, visit Email sender guidelines.

Gmail's page writes domain-name and ip-address where your bounce shows your own domain and the sending address.

550 5.7.30 This message was blocked because it didn't pass DKIM authentication. Gmail requires bulk email senders to authenticate their email with DKIM. Authentication results: DKIM = did not pass To set up DKIM for your sending domains, visit Set up DKIM. To learn more about Gmail requirements for bulk email senders, visit Email sender guidelines.

Why would a small firm see it?

DKIM was never turned on at the service, the record was published at the wrong name, or a footer was added to the message after it was signed.

How do I fix it?

1. Turn on DKIM signing for your domain at your mail provider, and at each other service that sends as your domain.Each one gives you a record to publish.
2. Publish each record exactly as the service shows it, at the name it gives, in your DNS host.
3. Send yourself a message and open its headers.Look for dkim=pass and your own domain after header.d= or d=.