550 5.7.26: Unauthenticated email: DMARC, SPF or DKIM failed
Gmail (and others) refused the message because it couldn't confirm it really came from the sender's domain. Since 2024, Gmail has rejected unauthenticated mail far more often.
Blocked The address is probably fine. The problem is how the mail was sent.
What the bounce message looks like
The wording changes from one provider to another. These are typical examples:
550 5.7.26 Unauthenticated email from example.com is not accepted due to domain's DMARC policy. (Gmail)550 5.7.26 This email has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM. (Gmail)Common causes
- No SPF record, or the sending service isn't listed in it
- DKIM signing isn't turned on
- SPF or DKIM passes, but for a different domain than the From address, so DMARC fails
- A forwarded message that broke SPF and DKIM
How to fix it if you sent the email
- Set up SPF and DKIM for your domain with every service that sends as you.
- Build a correct SPF record with the SPF generator and add DMARC with the DMARC generator.
- Test with the DMARC checker, then send again.
If you manage the receiving or sending mail system
- Turn on DKIM signing in your email platform and publish its key.
- Make sure the domain in the From address matches the domain that passes SPF or DKIM.
Free tool: paste the full bounce into the bounce message decoder to get a plain-English reading of every code in it.
Questions people ask
- What does 550 5.7.26 mean?
- Gmail (and others) refused the message because it couldn't confirm it really came from the sender's domain. Since 2024, Gmail has rejected unauthenticated mail far more often.
- Is 550 5.7.26 a hard or soft bounce?
- Blocked. The address is probably fine. The problem is how the mail was sent.
- Should I remove the address after a 5.7.26 bounce?
- No. Fix how the mail is sent; the address itself is probably fine.