# Gmail 550 5.7.26 "sender is unauthenticated": how to fix it A `550 5.7.26` bounce means Gmail refused the message because it could not confirm that your domain sent it. Nothing is wrong with the recipient's mailbox. The fix is in your domain's DNS records or in the settings of the service that sent the email. ## What the bounce says Google lists three versions of this error. The wording tells you which check failed. **1. Neither SPF nor DKIM passed:** ``` 550 5.7.26 This email has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM. Authentication results: DKIM = did not pass SPF [domain-name] with ip: [ip-address] = did not pass. ``` **2. SPF failed and your SPF record ends in `-all`:** ``` 550 5.7.26 The (E)MAIL FROM domain [domain-name] has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks with the ip: [ip-address]. To best protect our users from spam and phishing, the message has been blocked. ``` **3. DMARC failed and your policy says to reject it:** ``` 550 5.7.26 Unauthenticated email from domain-name is not accepted due to domain's DMARC policy. Contact the administrator of domain-name domain if this was legitimate email. ``` ## Why Gmail checks this Since 1 February 2024, Google's sender guidelines require **every** sender to personal Gmail accounts to set up SPF or DKIM. Senders of more than 5,000 messages a day must set up SPF, DKIM **and** DMARC, and the From domain must be aligned with the SPF or the DKIM domain. A DMARC policy of `p=none` is enough for that requirement. Google says that from November 2025 it is ramping up enforcement, and that non-compliant messages will see temporary and permanent rejections. A setup that used to get through may now bounce. ## Step 1: find which check failed Get the full headers of a message that Gmail rejected or delivered to spam, or send a test to a Gmail address you control. In Gmail, open the message, click **More** next to Reply, then **Show original**. Look for the `Authentication-Results` header. It records what the receiving server concluded. It looks like this: ``` Authentication-Results: mx.google.com; dkim=pass header.d=mailer.example.net; spf=pass smtp.mailfrom=bounces.mailer.example.net; dmarc=fail (p=REJECT) header.from=example.com ``` Here SPF and DKIM both pass, but for the sending service's domain, not for `example.com`. Neither is aligned with the From address, so DMARC fails. That is the most common cause of version 3. Then check what your domain publishes: ``` dig +short TXT example.com # SPF: starts with v=spf1 dig +short TXT _dmarc.example.com # DMARC dig +short TXT selector._domainkey.example.com # DKIM, with the selector from s= in the signature ``` ## Step 2: fix the cause ### SPF and DKIM both failed (version 1) The sending server isn't authorised at all. 1. Find the IP address in the bounce and identify which system owns it: your mailbox provider, a marketing platform, a CRM, a server's contact form. 2. Add that service to your SPF record with the `include:` or `ip4:` value its documentation gives. 3. Turn on DKIM signing **with your own domain** in that service and publish the DKIM record it gives you. Google requires a DKIM key of at least 1024 bits for personal Gmail accounts and recommends 2048. ### SPF hard fail (version 2) Your SPF record ends in `-all`, and the sending IP isn't listed in it. 1. Add the missing service to the SPF record, as above. 2. Check that you have **one** SPF record. Two `v=spf1` records break SPF. 3. Count the DNS lookups. SPF allows at most 10 `include`, `a`, `mx`, `ptr`, `exists` and `redirect` terms in total; past that, SPF returns an error. See [SPF "too many DNS lookups"](/guides/spf-too-many-dns-lookups). ### DMARC failed (version 3) Your DMARC policy is `quarantine` or `reject`, and the message passed neither SPF nor DKIM **aligned** with the From domain. 1. In the headers, compare `header.d=` (DKIM) and `smtp.mailfrom=` (SPF) with the From domain. At least one must match it, or be a subdomain of it. 2. The reliable fix is DKIM signing with your own domain in the sending service. Many services offer a "custom domain" or "domain authentication" setting for this. 3. If you can't fix a sender quickly, don't remove DMARC. Move that sender to a subdomain (`news.example.com`) with its own SPF, DKIM and DMARC records. If you are on `p=none` and still see version 1 or 2, the problem is SPF or DKIM, not DMARC. ## Related Gmail codes Gmail also sends `550 5.7.27` when a message "didn't pass SPF authentication" and `550 5.7.30` when it "didn't pass DKIM authentication". The fixes are the same as above. Before bouncing, Gmail often defers mail with a temporary `421 4.7.x` code: see [Gmail 421 4.7.x](/guides/gmail-421-4-7-temporary-block). ## After the fix Send a fresh test to a Gmail address and confirm `spf=pass`, `dkim=pass` and `dmarc=pass` in Show original. Then keep DMARC reports coming in, so the next new tool that sends as you without DKIM shows up in a report, not in a bounce. When everything passes, plan the move to enforcement with [DMARC p=none to p=reject](/guides/dmarc-none-to-reject). ## Check your domain The [free scan](/#scan) reads your SPF, DMARC and DKIM setup and flags what Gmail would reject. To check one record at a time, use the [DMARC checker](/tools/dmarc-checker) and the [SPF lookup counter](/tools/spf-lookup-counter). ## Sources - [Google Workspace: Gmail SMTP errors and codes](https://knowledge.workspace.google.com/admin/support/troubleshooting/gmail-smtp-errors-and-codes) - [Google: Email sender guidelines](https://support.google.com/a/answer/81126) - [Google: Email sender guidelines FAQ](https://support.google.com/a/answer/14229414) - [Gmail Help: Trace an email with its full headers](https://support.google.com/mail/answer/29436) - [RFC 8601: Message header field for indicating message authentication status](https://www.rfc-editor.org/rfc/rfc8601) - [RFC 7208: SPF (4.5 multiple records, 4.6.4 lookup limits)](https://www.rfc-editor.org/rfc/rfc7208) - [RFC 7489: DMARC](https://www.rfc-editor.org/rfc/rfc7489) --- Source: https://nameward.app/guides/550-5-7-26 (updated 2026-10-30)