550 5.7.26 is Gmail's way of saying "we cannot tell this message really comes from you". Your message failed email authentication (SPF, DKIM, or both), so Gmail refused it. Since Gmail tightened its sender rules in 2024, this is one of the errors senders meet most.
The good news: it is entirely fixable on your side, and once it is fixed, every recipient benefits. This page explains the two versions of the error and the exact fixes. For every other code, see our guide to SMTP bounce codes.
The two versions
1. Unauthenticated sender. Gmail's message says the mail was blocked because the sender is unauthenticated, and that Gmail requires all senders to authenticate with either SPF or DKIM. Neither check passed.
2. DMARC rejection. The message says that unauthenticated email from your domain is not accepted because of your domain's DMARC policy. Here your own DMARC record (p=reject or p=quarantine) told Gmail to refuse mail that does not pass aligned SPF or DKIM, and Gmail did exactly that.
There is also a temporary version, 421 4.7.26: Gmail slows down (rate limits) unauthenticated mail before refusing it. Treat it as a warning to fix the same things now.
What it means
- 550: a permanent refusal.
- 5.7.26: a security/policy failure (
.7), specifically failed authentication.
The address you wrote to is fine. The problem is how your message is signed and which servers are allowed to send for your domain.
How to fix it
Work through these in order, with the domain in your From address:
1. SPF: list every service that sends for you. Your domain's SPF record (a TXT record starting with v=spf1) must include your email provider and every tool that sends as your domain: newsletter platform, CRM, helpdesk, invoicing app. A tool missing from SPF is the most common cause. Keep it to one SPF record and under 10 DNS lookups. Check it with the SPF and DMARC checker.
2. DKIM: turn on signing in every sending tool. Each service that sends as your domain should sign with DKIM for your domain, using a key you publish in your DNS. Most platforms have a "domain authentication" page that gives you the records to add. Check the result with the DKIM checker; see also what a DKIM record is.
3. Alignment: the authenticated domain must match your From domain. Passing SPF or DKIM for the platform's domain is not enough for DMARC. The domain checked by SPF (the return path) or signed by DKIM (d=) must match the domain people see in the From address (or be a subdomain of it). To see which domains passed, send yourself a message at a Gmail address and paste its headers into the email header analyzer. The usual reasons for a mismatch are listed in DMARC fail: what it means and how to fix it.
4. DMARC: publish a record, start gently. If you do not have one yet, start with p=none and reports, look at which sources fail, fix them, and only then move to quarantine or reject. If you already have p=reject and you get the DMARC version of this error, one of your senders is not aligned: fix it rather than loosening the policy. Our DMARC generator builds the record.
5. Send again. Once the records pass, new messages are accepted. DNS changes can take up to a day or two to be visible everywhere.
Common situations
- "It works for Outlook but not Gmail." Gmail enforces authentication for everyone; other receivers may be more lenient. The fix is the same.
- "Only messages from our CRM bounce." That tool is not in your SPF or does not sign with DKIM for your domain.
- "Forwarded messages bounce." Forwarding breaks SPF; DKIM survives it. Make sure DKIM signs your mail.
Frequently asked questions
Is 550 5.7.26 a hard bounce?
It is a permanent refusal, but not an address problem. Do not remove the recipient: fix your authentication.
Do I need both SPF and DKIM?
Gmail accepts one of them for ordinary senders, but bulk senders (around 5,000 messages a day to Gmail) need both, plus DMARC. Having both is the safe choice for everyone.
Can verifying my list fix 5.7.26?
No. List verification removes addresses that do not exist; 5.7.26 is about your domain's setup. Both matter, for different reasons.