Skip to content

Guides · Email and DMARC

Gmail 550 5.7.26 "sender is unauthenticated": how to fix it

Gmail bounced your email with 550 5.7.26. What each version of the message means, how to find the failing check in the headers, and how to fix it.

Updated 30 October 2026 · 5 min read

A 550 5.7.26 bounce means Gmail refused the message because it could not confirm that your domain sent it. Nothing is wrong with the recipient's mailbox. The fix is in your domain's DNS records or in the settings of the service that sent the email.

What the bounce says

Google lists three versions of this error. The wording tells you which check failed.

1. Neither SPF nor DKIM passed:

550 5.7.26 This email has been blocked because the sender is unauthenticated.
Gmail requires all senders to authenticate with either SPF or DKIM.
Authentication results: DKIM = did not pass SPF [domain-name] with ip:
[ip-address] = did not pass.

2. SPF failed and your SPF record ends in -all:

550 5.7.26 The (E)MAIL FROM domain [domain-name] has an SPF record with a
hard fail policy (-all) but it fails to pass SPF checks with the ip:
[ip-address]. To best protect our users from spam and phishing, the message
has been blocked.

3. DMARC failed and your policy says to reject it:

550 5.7.26 Unauthenticated email from domain-name is not accepted due to
domain's DMARC policy. Contact the administrator of domain-name domain if
this was legitimate email.

Why Gmail checks this

Since 1 February 2024, Google's sender guidelines require every sender to personal Gmail accounts to set up SPF or DKIM. Senders of more than 5,000 messages a day must set up SPF, DKIM and DMARC, and the From domain must be aligned with the SPF or the DKIM domain. A DMARC policy of p=none is enough for that requirement.

Google says that from November 2025 it is ramping up enforcement, and that non-compliant messages will see temporary and permanent rejections. A setup that used to get through may now bounce.

Step 1: find which check failed

Get the full headers of a message that Gmail rejected or delivered to spam, or send a test to a Gmail address you control. In Gmail, open the message, click More next to Reply, then Show original.

Look for the Authentication-Results header. It records what the receiving server concluded. It looks like this:

Authentication-Results: mx.google.com;
       dkim=pass header.d=mailer.example.net;
       spf=pass smtp.mailfrom=bounces.mailer.example.net;
       dmarc=fail (p=REJECT) header.from=example.com

Here SPF and DKIM both pass, but for the sending service's domain, not for example.com. Neither is aligned with the From address, so DMARC fails. That is the most common cause of version 3.

Then check what your domain publishes:

dig +short TXT example.com          # SPF: starts with v=spf1
dig +short TXT _dmarc.example.com   # DMARC
dig +short TXT selector._domainkey.example.com   # DKIM, with the selector from s= in the signature

Step 2: fix the cause

SPF and DKIM both failed (version 1)

The sending server isn't authorised at all.

  1. Find the IP address in the bounce and identify which system owns it: your mailbox provider, a marketing platform, a CRM, a server's contact form.
  2. Add that service to your SPF record with the include: or ip4: value its documentation gives.
  3. Turn on DKIM signing with your own domain in that service and publish the DKIM record it gives you. Google requires a DKIM key of at least 1024 bits for personal Gmail accounts and recommends 2048.

SPF hard fail (version 2)

Your SPF record ends in -all, and the sending IP isn't listed in it.

  1. Add the missing service to the SPF record, as above.
  2. Check that you have one SPF record. Two v=spf1 records break SPF.
  3. Count the DNS lookups. SPF allows at most 10 include, a, mx, ptr, exists and redirect terms in total; past that, SPF returns an error. See SPF "too many DNS lookups".

DMARC failed (version 3)

Your DMARC policy is quarantine or reject, and the message passed neither SPF nor DKIM aligned with the From domain.

  1. In the headers, compare header.d= (DKIM) and smtp.mailfrom= (SPF) with the From domain. At least one must match it, or be a subdomain of it.
  2. The reliable fix is DKIM signing with your own domain in the sending service. Many services offer a "custom domain" or "domain authentication" setting for this.
  3. If you can't fix a sender quickly, don't remove DMARC. Move that sender to a subdomain (news.example.com) with its own SPF, DKIM and DMARC records.

If you are on p=none and still see version 1 or 2, the problem is SPF or DKIM, not DMARC.

Gmail also sends 550 5.7.27 when a message "didn't pass SPF authentication" and 550 5.7.30 when it "didn't pass DKIM authentication". The fixes are the same as above. Before bouncing, Gmail often defers mail with a temporary 421 4.7.x code: see Gmail 421 4.7.x.

After the fix

Send a fresh test to a Gmail address and confirm spf=pass, dkim=pass and dmarc=pass in Show original. Then keep DMARC reports coming in, so the next new tool that sends as you without DKIM shows up in a report, not in a bounce. When everything passes, plan the move to enforcement with DMARC p=none to p=reject.

Check your domain

The free scan reads your SPF, DMARC and DKIM setup and flags what Gmail would reject. To check one record at a time, use the DMARC checker and the SPF lookup counter.

Sources

Free scan

No signup. Only scan domains you own or manage.

More in Email and DMARC