Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
SMTP error code · Gmail / Google Workspace

550 5.7.26: Gmail blocked an unauthenticated message

550 5.7.26 Permanent failure (5xx): the message bounced
By iBlockSpam Team Checked against sources 4 sources How we check our content
What it means

Gmail rejected the message because it failed authentication: neither SPF nor DKIM passed, SPF hard-failed, or the sending domain's DMARC policy says to reject it.

What the bounce says
550 5.7.26 This email has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM.

Start of the first of three 550 5.7.26 texts in Google's SMTP errors reference. Gmail's replies can run over several lines; RFC 5321 says every line except the last starts with the code followed by a hyphen, so the same error can appear as 550-5.7.26.

What 550 5.7.26 means

RFC 7372 registered X.7.26, "Multiple authentication checks failed", for a message that failed more than one authentication check, contrary to local policy. Gmail uses 550 5.7.26 with three different texts, and each points to a different fix:

  1. "The sender is unauthenticated." Neither DKIM nor SPF passed. The bounce shows both results, for example "DKIM = did not pass" and the SPF domain and IP that didn't pass. Gmail's sender guidelines require every sender to set up SPF or DKIM.
  2. "The (E)MAIL FROM domain [...] has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks." The server that sent the message isn't in the SPF record of the envelope sender's domain.
  3. "Unauthenticated email from <domain> is not accepted due to domain's DMARC policy." The message failed DMARC, and the domain in the From header publishes a reject policy. Gmail followed the domain owner's instruction.

The third case is the one most often seen after a domain moves to "p=reject" without listing every sending service, or when a third party sends mail "from" your domain without being authorized. Forwarding can also break SPF, so DKIM is what keeps forwarded mail passing.

Likely causes

  • A service sending as your domain (CRM, website, scanner, helpdesk) has no DKIM signature and isn't in your SPF record.
  • The sending server isn't listed in an SPF record that ends in -all.
  • Your DMARC policy is p=reject (or quarantine) and the message isn't aligned with your domain.
  • DKIM signing is set up for a different domain than the one in the From header.
  • The message was forwarded, breaking SPF, and had no valid DKIM signature.

How to fix it

If you sent the message

  1. Read which of the three texts you got: it tells you whether SPF, DKIM or DMARC is the problem.
  2. Add every legitimate sending service to SPF, and turn on DKIM signing with your own domain at each one.
  3. Check your DMARC reports for sources that fail before tightening the policy.
  4. If someone else is sending as your domain without permission, the rejection is DMARC working as intended.

If you're the recipient or their admin

  1. Nothing to change at Gmail: it's following the sender domain's published policy. Ask the sender to fix their authentication.
DMARC Checker SPF Checker DKIM Checker

Frequently asked questions

Do I need both SPF and DKIM to send to Gmail?

Gmail's sender guidelines require all senders to set up SPF or DKIM. Senders of close to 5,000 or more messages a day to personal Gmail accounts need SPF, DKIM and DMARC. Having both SPF and DKIM is the safer choice, because forwarding often breaks SPF but not DKIM.

Why does Gmail reject mail from my domain when I didn't send it?

If the text mentions your DMARC policy, someone sent mail using your domain without passing authentication, and Gmail rejected it because your policy says to. That's the protection DMARC is designed to give.

How fast does a fix take effect?

As soon as receivers see your updated DNS records, which depends on the records' TTL. Send a test message to a Gmail account and check the Authentication-Results header for spf=pass, dkim=pass and dmarc=pass.

Sources

  1. Gmail SMTP errors and codes (Google Workspace Admin Help)
  2. Email sender guidelines (Gmail Help)
  3. RFC 7372: Email Authentication Status Codes
  4. RFC 5321, section 4.2: SMTP replies (multiline reply format)

Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.

Related codes

Related guides

SPF, DKIM & DMARC

SPF vs DKIM vs DMARC: what each one proves, and what it doesn't

A plain-English comparison of SPF, DKIM and DMARC: what each checks, what it can't prove, how they work together, and where MTA-STS and BIMI fit.

8 min read SPF, DKIM & DMARC

Moving DMARC from p=none to p=reject: a staged rollout for small businesses

A staged plan to move DMARC from monitoring to reject without blocking your own mail, including what changes when a filtering gateway sits in front.

9 min read SPF, DKIM & DMARC

Why email forwarding breaks SPF and DMARC, and how ARC helps

Why forwarding and mailing lists break SPF and sometimes DKIM, how that fails DMARC, and how SRS, ARC and trusted ARC sealers in Microsoft 365 help fix it.

9 min read SPF, DKIM & DMARC

Why does DMARC fail? Causes and fixes for dmarc=fail

Troubleshoot dmarc=fail: alignment vs pass, third-party senders, forwarding, subdomains, DKIM d= and SPF MAIL FROM mismatches, with a causes-to-fixes table.

9 min read