Skip to content
inboxprobe

Checkers

Generators

Guides

Bounce error codes · Gmail and Google Workspace

Gmail 5.7.27: SPF authentication didn't pass

Gmail rate-limited (4.7.27) or blocked (5.7.27) your message because it failed SPF, and Gmail requires bulk senders to pass SPF.

The exact error texts

  • 550 5.7.27 This message was blocked because it didn't pass SPF authentication. Gmail requires bulk email senders to authenticate their email with SPF. Authentication results: SPF with ip-address = did not pass

  • Temporary version

    421 4.7.27 Your email has been rate limited because SPF authentication didn't pass for this message. Gmail requires all bulk email senders to authenticate their email with SPF. Authentication results: SPF domain-name with IP address: ip-address = Did not pass.

Quoted from Google Workspace — Gmail SMTP errors and codes

Check your domain

Find out which record is missing or failing. The check runs in your browser and takes a few seconds.

What 5.7.27 means

Google requires senders of more than 5,000 messages a day to Gmail to set up both SPF and DKIM. A 5.7.27 says the SPF half failed for this message, even if DKIM passed. The 4.7.27 version is a temporary rate limit; the 5.7.27 version is a block.

SPF is checked for the envelope sender domain (the Return-Path, also called MAIL FROM), not the From address you see. With many sending services, that's a bounce subdomain such as em123.yourdomain.com or the service's own domain.

Why SPF fails

CauseHow to spot itFix
The sending server isn't listedspf=fail or softfail with the IP in the bounceAdd the service's include or the IP.
More than 10 DNS lookupsspf=permerror; our check shows the totalRemove unused includes; replace a/mx with ip4: where you can.
Two SPF records on one namespf=permerrorMerge them into one v=spf1 record.
Syntax errorspf=permerrorRebuild it with the SPF generator.
No SPF at the Return-Path domainspf=nonePublish SPF on that exact name, or set up the service's custom return path.

Fix it step by step

  1. Open a message from the failing system in Gmail → Show original, or paste its headers into the header analyzer. Note the smtp.mailfrom domain and the sending IP.
  2. Check that domain with the SPF checker. It expands every include and counts lookups the way receivers do.
  3. Add what's missing to the same record. Never publish a second SPF record.
  4. If the service sends from its own Return-Path domain, its SPF is the service's job. Your part is DKIM with your domain for DMARC alignment.

One record, every sender

Type
TXT
Host / name
@
Value
v=spf1 include:_spf.google.com include:<your sending service> ~all

Questions

My DKIM passes. Why does Gmail still block on SPF?

For bulk senders Google requires both SPF and DKIM, so passing one isn't enough for this rule, even though DMARC itself only needs one aligned pass.

Does ~all or -all matter for 5.7.27?

Either way, if the sending IP isn't authorised the result isn't a pass. -all makes it a hard fail, which can also trigger Gmail's SPF hard-fail version of 550 5.7.26.

Which domain's SPF record does Gmail check?

The envelope sender (Return-Path / MAIL FROM) domain. Gmail's 4.7.27 bounce names it: “SPF domain-name with IP address…”.

I'm below 5,000 messages a day. Does this apply?

This error is about Gmail's bulk-sender rule. Smaller senders need SPF or DKIM; without either, Gmail answers with 5.7.26 instead.

Sources

Last reviewed: