550 5.7.26 — unauthenticated email

Gmail permanently rejected your message because it was not authenticated — neither SPF nor DKIM passed and aligned with your From domain. Here is why, what it costs you, and how to fix it.

Check your domain free → Jump to the fix ↓

What it means

The cause.

550 5.7.26 is a permanent SMTP rejection (the 5xx class means the message will not be retried) with the enhanced status code 5.7.26, which sits in the 5.7.x security and policy family. Gmail returns it when it cannot confirm that the message genuinely came from the domain in your From address. The bounce text reads either "this mail is unauthenticated" or "unauthenticated email from [domain] is not accepted due to domain's DMARC policy".

To be authenticated, a message must pass at least one of SPF or DKIM, and the domain that passed must align with the domain in the visible From header. So the code fires in three situations: SPF fails because the sending IP is not in your record; DKIM fails because the message is unsigned or the signature does not verify against the key in DNS; or one of them passes but against a different domain than your From, so alignment fails. Forwarding and third-party senders that mail as your domain without being authorised are the usual triggers.

This is not a spam-score warning or a temporary defer. Gmail has decided your message is unauthenticated at the protocol level and refused it at the SMTP conversation. It will keep refusing every message on the same basis until the sending domain is authenticated correctly.

Why it matters

The impact.

A 5.7.26 rejection means the message never reaches the inbox or the spam folder — it is bounced back to the sending server, so the recipient sees nothing at all. Because it is a 5xx code, there is no automatic retry, and each blocked send erodes your domain's standing with Gmail.

Since February 2024, Gmail and Yahoo require bulk senders (from 5,000 messages a day) to authenticate with SPF and DKIM and to publish DMARC, with the authenticated domain aligned to the From header. 5.7.26 is exactly how Gmail enforces that: mail that used to slip through unauthenticated is now refused outright rather than merely filtered, so an unauthenticated setup that once "worked" stops delivering.

What to do

The fix, in order.

Work top to bottom, then re-check — DNS changes take a few minutes to take effect.

1 Read the bounce to see which check failed. The full 5.7.26 text often names the culprit — "SPF check for [domain] did not pass" or "DKIM checks did not pass". That tells you whether to fix SPF, DKIM, or both, rather than guessing.
2 Publish or correct your SPF record. Make sure a single TXT record starting v=spf1 authorises every service that sends as your domain, and that it resolves without a PermError. The IP or provider you are actually sending from must be covered by an include: or ip4:/ip6: mechanism, otherwise SPF cannot pass.
3 Enable DKIM signing and publish the key. Turn on DKIM at your sending platform and publish the public key it gives you at the selector host in DNS (for example selector._domainkey.yourdomain.com). An unsigned message, or a signature that does not verify against the published key, counts as a DKIM failure.
4 Fix alignment with your From domain. Passing is not enough — the passing domain must match your From domain. If you send as [email protected], the SPF envelope domain or the DKIM d= domain must be yourdomain.com (or a subdomain of it). A tool sending as your address but authenticating under its own domain will still trip 5.7.26.
5 Publish a DMARC record. Add a _dmarc TXT record, starting at v=DMARC1; p=none, so Gmail has an explicit policy for your domain and you receive aggregate reports showing which sources pass and align. This satisfies the bulk-sender requirement and lets you catch unauthenticated senders before they cause rejections.
6 Re-check, then send a test. DNS changes take a few minutes to propagate. Run your domain through the domain checker to confirm SPF, DKIM, DMARC and alignment all pass, then send a fresh message to a Gmail address and confirm it is accepted.

Starter DMARC record

host _dmarc type TXT

v=DMARC1; p=none; rua=mailto:[email protected]

Confirm the error is gone.

Run a full check on your domain — it reads SPF, DKIM and DMARC live and tells you, in plain terms, whether the thing behind this error is fixed. Free, no account.

Check your domain → Or send a test email

Common questions

About this error.

What does 550 5.7.26 unauthenticated email mean? It is a permanent Gmail rejection meaning the message was not authenticated: neither SPF nor DKIM passed and aligned with the domain in your From address, so Gmail could not confirm the mail genuinely came from that domain and refused it.

How do I fix 550 5.7.26 unauthenticated email? Authenticate the sending domain. Publish a valid SPF record covering the IPs you send from, enable DKIM signing and publish its key in DNS, make sure the passing domain aligns with your From domain, and publish a DMARC record. Then re-check and send a test to Gmail.

Is 550 5.7.26 permanent or temporary? Permanent. The 5xx class marks it as a hard failure, so the sending server will not retry the message automatically. It keeps recurring until the domain is authenticated correctly.

Is 5.7.26 an SPF, DKIM or DMARC problem? It is an authentication failure that spans all three. Gmail needs at least one of SPF or DKIM to pass and align with your From domain; when neither does, or DMARC has no aligned pass, you get 5.7.26. The bounce text usually names which check failed.

Why do I get 5.7.26 when my email has SPF and DKIM? Almost always alignment. SPF or DKIM can pass under a different domain — a sending platform's own domain, or a bounce address that is not yours — while your visible From is your domain. Gmail requires the passing domain to match your From domain, so an unaligned pass still fails.

Does 550 5.7.26 relate to the Gmail and Yahoo 2024 rules? Yes. Since February 2024 Gmail and Yahoo require senders to authenticate with SPF and DKIM, align them to the From domain, and publish DMARC. 5.7.26 is how Gmail enforces this, rejecting unauthenticated mail outright instead of only filtering it.

Fix the cause, and check it.

Blacklist checker → Check your domain and every sending IP against the lists receivers consult. Spamhaus ZEN removal → If a listing is behind the bounce, here is how to get your IP off it. Full domain check → SPF, DKIM, DMARC, MX and the blacklists, scored in one run.