Skip to content
inboxprobe

Checkers

Generators

Guides

Bounce error codes · Gmail and Google Workspace

Gmail 550 5.7.26: unauthenticated email blocked

Gmail blocked the message because it couldn't confirm it really came from your domain. Google uses 5.7.26 for three different failures, so start by matching the text.

The exact error texts

  • Neither SPF nor DKIM passed

    550 5.7.26 This email has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM. Authentication results: DKIM = did not pass SPF [domain-name] with ip: [ip-address] = did not pass. For instructions on setting up authentication, go to Email sender guidelines.

  • SPF hard fail (-all)

    550 5.7.26 The (E)MAIL FROM domain [domain-name] has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks with the ip: [ip-address]. To best protect our users from spam and phishing, the message has been blocked. For more information, go to Email sender guidelines.

  • Failed the domain's DMARC policy

    550 5.7.26 Unauthenticated email from domain-name is not accepted due to domain's DMARC policy. Contact the administrator of domain-name domain if this was legitimate email. To learn about the DMARC initiative, go to Control unauthenticated email from your domain.

  • Temporary version: rate limited

    421 4.7.26 This email has been rate limited because it is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM. Authentication results: DKIM = did not pass SPF domain-name with ip: ip-address = did not pass. To resolve this issue, go to Email sender guidelines.

Quoted from Google Workspace — Gmail SMTP errors and codes

Check your domain

Find out which record is missing or failing. The check runs in your browser and takes a few seconds.

Which 5.7.26 did you get?

Bounce starts withWhat failedWhere to look
“This email has been blocked because the sender is unauthenticated”Both SPF and DKIM. Gmail requires at least one from every sender.Is the message DKIM-signed at all? Is the sending IP in SPF?
“The (E)MAIL FROM domain … has an SPF record with a hard fail policy (-all)”SPF, and your record says to fail hard.The IP in the bounce isn't covered by the SPF record.
“Unauthenticated email from … is not accepted due to domain's DMARC policy”DMARC: neither SPF nor DKIM passed for a domain aligned with From.Which domain SPF and DKIM passed for, compared with From.

Fix: no SPF or DKIM pass

This applies to everyone, not only bulk senders. It's typical of a server sending directly, like a website contact form, a scanner or a self-hosted app, that isn't in your SPF record and doesn't sign with DKIM.

  • Route the system through your mail provider (Google Workspace, Microsoft 365) or a sending service that signs with DKIM for your domain.
  • Or add its IP to SPF (ip4:203.0.113.10) and set up DKIM on it. The SPF generator keeps the record valid and under 10 lookups.

Fix: SPF hard fail

Your SPF record ends in -all and the IP in the bounce isn't covered, so Gmail blocks the message even without looking further. The SPF record that counts is the one for the envelope sender (Return-Path / MAIL FROM) domain, which can differ from your From address.

  1. Take the IP from the bounce and find which service owns it (the header analyzer shows the sending IP of a delivered message).
  2. Add that service's documented include, or the IP, to your one SPF record.
  3. Run the SPF checker to confirm the record is valid and under 10 lookups. An SPF record that errors out doesn't pass either.

Fix: the DMARC version

Your domain publishes a DMARC policy that tells receivers not to accept failing mail, and this message failed: SPF or DKIM may have passed, but not for your From domain. The usual causes:

  • A sending service signs with its own domain (d= isn't yours) and uses its own Return-Path. Set up custom DKIM in that service: see the guides for Mailchimp, SendGrid or Brevo.
  • Google Workspace without DKIM turned on, so messages aren't signed with your domain. See DKIM for Google Workspace.
  • Forwarding: the message reached Gmail through a forwarder that broke SPF and changed the message. Google publishes best practices for forwarding to Gmail.

If Gmail's 451 4.7.26 version mentions “temporary DNS failures”, your DMARC policy applies but Gmail couldn't look up your records at the time. Check that your DNS host answers reliably; the message is retried.

Questions

Do I need both SPF and DKIM to avoid 5.7.26?

Gmail requires every sender to pass at least one of them, and bulk senders (more than 5,000 messages a day to Gmail) to set up both plus DMARC. Set up both: DKIM survives forwarding, SPF doesn't.

Should I change -all to ~all to stop the hard-fail bounces?

It hides the symptom. The real problem is a server sending as your domain that isn't in SPF. Add it to the record. With ~all the message may still fail DMARC.

Why do I get 5.7.26 for mail I didn't send?

If the bounce is for a message you never sent, someone spoofed your domain and Gmail blocked it, often because of your DMARC policy. That's the protection working.

What's the difference between 421 4.7.26 and 550 5.7.26?

421 4.7.26 is temporary: Gmail rate-limited the unauthenticated message and your server will retry. 550 5.7.26 is a permanent block. Both mean the same fix: authenticate the mail.

Sources

Last reviewed: