Fix & Verify

Gmail · bounce code

550 5.7.26: Gmail rejects unauthenticated mail

Gmail uses 550 5.7.26 for three different authentication failures. The text after the code tells you which one — and which record to fix.

Check your domain — free

The three messages

550 5.7.26 This email has been blocked because the sender is unauthenticated.
Neither SPF nor DKIM passed. Gmail requires every sender to authenticate with SPF or DKIM.
550 5.7.26 The (E)MAIL FROM domain […] has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks
The server that sent the message is not listed in your SPF record, and the record ends in -all.
550 5.7.26 Unauthenticated email from […] is not accepted due to domain's DMARC policy.
Your DMARC policy is quarantine or reject, and neither SPF nor DKIM passed aligned with your From domain.

What Gmail requires

  • All senders (since 1 February 2024): SPF or DKIM for the sending domain; a DKIM key of 1024 bits or longer when sending to personal Gmail accounts.
  • More than 5,000 messages a day to Gmail accounts: SPF and DKIM, a DMARC record (p=none is allowed), and the From domain aligned with the SPF or DKIM domain.

How to fix it

  1. Find the sending service in the bounce or the message header (mailbox provider, newsletter tool, CRM, invoicing).
  2. SPF: add that service's include to your single SPF record and stay within 10 DNS lookups.
  3. DKIM: publish the service's DKIM key and switch signing on in the service.
  4. DMARC: keep p=none with reports until every legitimate service passes aligned, then tighten.

Check which part fails

Reads your domain's public DNS and shows SPF, DKIM and DMARC with the exact records to change. The domain is kept in memory for at most 10 minutes; see privacy policy, section 8.

What a fix cannot promise

Passing authentication is a requirement, not a guarantee: content, list quality and sender reputation also decide where mail lands. We do not promise inbox placement.

Sources

Fix & Verify: we work out the exact records for every service that sends as your domain, you publish them, we re-check independently.