Gmail bounce "550 5.7.26": unauthenticated email

What it means

You received an error message (a "bounce") that looks like this:

550 5.7.26 This mail has been blocked because the sender is unauthenticated.
Gmail requires all senders to authenticate with either SPF or DKIM.

Other versions of the same code say "Unauthenticated email from yourdomain.com is not accepted due to domain's DMARC policy". In every case, Gmail checked the email, could not prove it came from your domain, and refused it.

Why it matters

This is not a spam filter: the email is not in spam, it was never delivered. Every email sent the same way will be refused the same way until the setup is fixed.

The usual causes

• No SPF and no DKIM for your domain.
• SPF fails: the server that sent the email is not listed in your SPF record.
• DMARC fails: SPF or DKIM passed, but for another domain (for example your newsletter tool's domain), and your DMARC policy is quarantine or reject.
• Forwarding: the email went through a forwarding address or a mailing list that broke SPF, and there was no DKIM signature to save it.
• Someone else is spoofing your domain, and the bounce is a backscatter you did not cause. See the spoofing guide.

How to check

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report. Use exactly the same tool that got the bounce. The SPF, DKIM and DMARC lines show which check fails, and for which domain.
• Use the Domain scanner: type your domain at /domain-scanner to read your records.

How to fix it

1. Identify the sender. Look at the bounce: which tool or server sent the refused email? Your mailbox, a website, a CRM, an invoicing tool?
2. Add it to SPF. Add the include: or ip4: value given by that service to your single SPF record.
3. Turn on DKIM in that service with your own domain and publish the key it gives you. DKIM survives forwarding, SPF does not.
4. Check alignment. The From address domain must match the SPF or DKIM domain. In newsletter tools, use the "authenticate your domain" option.
5. Avoid sending as a domain you do not control. A website sending as @gmail.com will always fail.

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Send a new test email from the home page with the same tool. SPF or DKIM must pass for your domain, and DMARC must pass. Then resend the refused email to the Gmail recipient.

More help: Google email sender guidelines.