550 5.7.26 is Gmail refusing a message because it couldn’t confirm the message really came from the domain in its From address. Nothing is wrong with the recipient’s mailbox. The sending domain’s SPF, DKIM or DMARC setup failed for that message, and because 550 is a permanent error, the sending server won’t retry.
Two details in the bounce tell you where to look: the wording after the code, which says which check failed, and the domain it names. If the domain is yours, one of your sending services isn’t authenticated. If it’s another company’s domain, they need to fix it, unless forwarding on your side broke their authentication.
Since February 1, 2024, Google has required everyone sending to personal Gmail accounts to pass SPF or DKIM, and bulk senders to pass both and publish DMARC. Google says it began ramping up enforcement in November 2025, so mail that used to slip through is more likely to bounce.
Try these first
- Copy the full bounce and note the wording after 550 5.7.26 plus the domain and any IP it names.
- Work out which service sent the failing message: your mailboxes, a website form, a CRM, a copier or a forward.
- Check the domain has exactly one SPF record that includes every service sending as it.
- Turn on DKIM in the Microsoft Defender portal (formerly the Microsoft 365 Defender portal) or the Google Admin console.
- Publish or review DMARC, starting at p=none with reports before quarantine or reject.
- Send a test to a personal Gmail address and confirm spf, dkim and dmarc all pass in the headers.
Which 5.7.26 bounce do you have?
Gmail uses this one code for three different failures. Match the wording in your bounce to the table.
| Bounce wording includes | What failed | First thing to fix |
|---|---|---|
| “the sender is unauthenticated”, with DKIM and SPF both shown as “did not pass” | Neither SPF nor DKIM passed, and Gmail requires at least one from every sender | Add the sending service to SPF, turn on DKIM, or both |
| “has an SPF record with a hard fail policy (-all)” | The sending IP isn’t in the SPF record of the envelope sender (MAIL FROM) domain the bounce names, and that record ends in -all | Add the missing service to SPF, and give it DKIM so it doesn’t rely on SPF alone |
| “550 5.7.26 Unauthenticated email from example.com is not accepted due to domain’s DMARC policy” | The message failed DMARC, and the domain’s DMARC policy tells receivers to reject failures. DMARC needs SPF or DKIM to pass for the same domain as the From address | Find the sender whose SPF or DKIM domain doesn’t match the From domain, and align it |
Nearby codes point at the same records. 451 4.7.26 is the DMARC version caused by a temporary DNS failure, so the sender retries; make sure your DNS host is answering reliably. 421 4.7.26 means Gmail is rate limiting unauthenticated mail rather than refusing it. Bulk senders may instead see 5.7.27 (SPF didn’t pass), 5.7.30 (DKIM didn’t pass), 5.7.32 (From header not aligned) or 5.7.40 (no DMARC record).
Microsoft’s equivalents are 550 5.7.515 (Outlook.com, high-volume senders failing SPF, DKIM or DMARC) and 550 5.7.509 (Microsoft 365, mail failing a p=reject DMARC policy). The same fixes apply.
Find the service that actually sent it
Often the staff mailboxes pass and the failure comes from something else sending “as” the domain. Match the sending IP to the program that sent it. The DMARC version of the bounce doesn’t show the IP, so check the Received lines of the returned original message.
To identify an IP, run nslookup and the IP in Command Prompt. A name ending in outbound.protection.outlook.com is Microsoft, google.com is Google, and a hosting company’s name usually means your website’s server.
| Sender | Why it fails | Fix |
|---|---|---|
| Microsoft 365 mailboxes | SPF lacks include:spf.protection.outlook.com, or DKIM was never turned on for your domain, so forwarded mail fails DMARC | Fix SPF and enable DKIM (below) |
| Google Workspace mailboxes | SPF lacks include:_spf.google.com, or the DKIM key was generated but never published or started | Fix SPF and finish DKIM setup |
| Outbound filtering or email-signature service | Mail leaves from its servers, which aren’t in SPF, or it changes messages after they were DKIM-signed, which breaks the signature | Follow its setup guide for SPF and DKIM so the message is signed after the service changes it |
| Website contact form | The web host’s server puts your address, or the visitor’s, in From and sends from an IP that isn’t in SPF, without DKIM | Send form mail through your mail provider or a sending service that signs with your domain; put the visitor’s address in Reply-To |
| CRM, invoicing, ticketing or newsletter tool | It was never authorized for your domain | Complete the vendor’s domain authentication: the DKIM records it gives you, plus an SPF include only if it asks for one. Microsoft suggests a subdomain for services you don’t control |
| Copier, scanner or office program sending directly | The office IP isn’t in SPF | Send through Microsoft 365 or Google instead (see scan to email with Office 365 or Gmail app passwords and SMTP). An ip4: entry for a static office IP only fixes SPF; Gmail also requires matching forward and reverse DNS (PTR) and TLS, which an office connection or older copier may lack |
| Forwarding, such as a registrar alias or a rule forwarding to Gmail | The forwarding server isn’t in the original sender’s SPF, so SPF fails; if DKIM is missing or the message gets modified, DMARC fails too | Sign your own mail with DKIM. For other domains’ mail, deliver to a real mailbox instead of forwarding, or use a forwarder that rewrites the envelope sender, as Google recommends |
If the bounce names yahoo.com, aol.com or another provider’s domain rather than yours, that provider’s address was sent through someone else’s server. Yahoo and AOL publish p=reject DMARC policies, so those messages bounce; gmail.com publishes p=none, but Google warns that impersonating Gmail From addresses can hurt delivery. If a mail app, phone or copier sends your own Gmail or Yahoo address through your web host’s or internet provider’s server, Google’s fix is to switch the outgoing (SMTP) server to the one that matches the address, such as smtp.gmail.com for Gmail.
Fix SPF: one record listing every sender
SPF is a single TXT record on your domain listing the servers allowed to send as it. Before editing, screenshot or export your current DNS records so you can put them back if something breaks.
To check what’s published, run nslookup -type=txt example.com (SPF) or nslookup -type=txt _dmarc.example.com (DMARC) in Command Prompt, before and after each change. Many DNS hosts add your domain to the host name, so enter only _dmarc or selector1._domainkey; typing the full name can create _dmarc.example.com.example.com.
Example records for example.com:
- Microsoft 365 only:
v=spf1 include:spf.protection.outlook.com -all - Google Workspace only:
v=spf1 include:_spf.google.com ~all - Microsoft 365, plus a copier on a static office IP, plus a service whose setup guide asks for an include:
v=spf1 ip4:203.0.113.25 include:spf.protection.outlook.com include:_spf.vendor.example -all
The rules that trip people up:
- One SPF record per domain. A second TXT record starting
v=spf1makes SPF return a permanent error for all your mail. Add new services to the existing record instead. - Only add an include a vendor asks for. Some services, Mailchimp among them, authenticate your domain with DKIM CNAME records and DMARC and send from their own envelope domain, so an SPF include for them only uses up lookups.
- No more than 10 DNS lookups. Each
include:,a,mx,existsandredirectcounts, including lookups nested inside includes;ip4:andip6:don’t. Past 10, SPF fails. Moving marketing tools to a subdomain gives them their own allowance. -allor~all. Microsoft recommends-all(hard fail) for Microsoft 365 domains; Google recommends~all(soft fail). With-all, a sender you forgot can trigger the hard-fail version of this bounce, so take inventory first.- Subdomains need their own record. The record on example.com doesn’t cover news.example.com.
SPF checks the envelope sender, the hidden return address servers use, not the From line people see. That’s why a service can pass SPF on its own domain and still fail DMARC for yours, and why DKIM matters.
Turn on DKIM in Microsoft 365 and Google Workspace
Microsoft 365
- In the Microsoft Defender portal at security.microsoft.com, go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings, then open the DKIM tab.
- Click the domain’s row to open its details. If it says no DKIM keys are saved, select Create DKIM keys. Copy the two values under Publish CNAMEs.
- At your DNS host, create two CNAME records with the hosts
selector1._domainkeyandselector2._domainkey, each pointing to the value the portal shows. Copy the values rather than typing them. - Once Microsoft 365 detects the records, turn on Sign messages for this domain with DKIM signatures.
In Exchange Online PowerShell, Get-DkimSigningConfig -Identity example.com | Format-List Enabled,Status shows whether signing is on.
Google Workspace
- In the Admin console, go to Menu > Apps > Google Workspace > Gmail > Authenticate email and select the domain. Generating the key needs a super administrator.
- Click Generate New Record, choose 2048-bit if your DNS host supports it (1024 otherwise) and keep the prefix
googleunless that selector is already in use. - At your DNS host, add a TXT record with the host
google._domainkeyand the value Google shows, which startsv=DKIM1; k=rsa; p=. - Back on Authenticate email, click Start authentication. The status should change to Authenticating email with DKIM; Google says DKIM can take up to 48 hours to start working.
Rather have a technician sort it out?
If your mail keeps bouncing with 5.7.26, a technician can connect remotely, read the bounce and headers with you and fix your domain’s SPF, DKIM and DMARC records. A GoProIT technician can connect remotely, with your permission, and fix it while you watch. $59 per fix, Mon–Fri 8am–8pm ET.
Add DMARC without blocking your own mail
DMARC is a TXT record at _dmarc.example.com telling receivers what to do with mail that doesn’t pass SPF or DKIM for the From domain, and where to send reports. A safe first record:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
p=nonechanges nothing about delivery, but receivers send daily aggregate reports to theruaaddress. Create that mailbox or group first.- The
vandptags must come first. Google says to let SPF and DKIM run for 48 hours before adding DMARC. - When the reports show every legitimate service passing, move to
p=quarantine(failures go to spam), thenp=reject(failures bounce, which is where the DMARC version of 5.7.26 comes from).
If your domain is already at p=reject and a legitimate service is getting the DMARC version of 5.7.26, dropping to p=none stops those rejections while you fix it. It won’t clear the “sender is unauthenticated” version, because Gmail requires SPF or DKIM to pass whatever your DMARC policy says. Lowering the policy also makes spoofed mail in your name easier to deliver, so treat it as temporary and set it back.
Gmail’s bulk sender rules
Google treats a domain that sends close to 5,000 or more messages a day to personal Gmail accounts as a bulk sender, counting subdomains under the same primary domain, and the status is permanent. Gmail’s bulk sender requirements are SPF and DKIM, a DMARC record (p=none is acceptable), a From domain aligned with SPF or DKIM, and one-click unsubscribe on marketing mail. Setting up SPF, DKIM and a staged DMARC rollout for your domain is part of our email security and 2FA setup.
Check the fix in the message headers
- From each service you changed, send a test to a personal Gmail address you can open. Google notes you can’t verify DKIM by sending a test to yourself.
- In Gmail on a computer, open the message, click More next to Reply and choose Show original.
- Find the
Authentication-Resultsheader. You wantspf=pass,dkim=passanddmarc=pass, with the DKIM domain matching your From domain. Gmail shows that domain asheader.i=@example.comhere; thed=value is in the separateDKIM-Signatureheader. - For a readable breakdown, click Copy to clipboard, open Google Admin Toolbox Messageheader at toolbox.googleapps.com/apps/messageheader, paste the header and click Analyze the header above.
In classic Outlook, headers are under File > Properties > Internet headers. DNS changes aren’t instant, so if a test fails right after an edit, wait and retest.
When it isn’t your domain, and when to get help
If someone trying to email you got the bounce and it names their domain, your settings aren’t involved; their IT or email provider has to fix it. Our guide to Gmail not receiving emails covers the receiving side. The exception is forwarding you set up, such as a registrar alias that forwards to Gmail: replace it with a real mailbox.
Get help when:
- Your SPF record is already near 10 lookups, or nobody knows every service that sends as your domain.
- DMARC reports show servers you don’t recognize sending as your domain, which can mean someone is spoofing you.
- You can’t sign in to your DNS host, or records went missing after a domain or website move.
If you’d rather not do this yourself, clearing a 5.7.26 bounce for one domain is a typical $59 remote fix; you approve the session and can end it at any time. Keeping DKIM and the rest of your mail security set up is part of our Microsoft 365 management and Google Workspace management.
Common questions
What does 550 5.7.26 mean?
It’s Gmail permanently rejecting a message that failed authentication. Either SPF and DKIM both failed, the SPF record of the envelope sender domain (which can differ from the From address) hard-failed the sending IP, or the From domain’s DMARC policy told Gmail to reject it. The sending server won’t retry. The fix is almost always in the sending domain’s DNS records or sending service; the exception is a forward the recipient set up, which can break the sender’s authentication.
Can the recipient fix a 5.7.26 bounce?
Usually not. The owner of the sending domain has to fix SPF, DKIM or DMARC. Google says messages that fail DMARC are generally handled according to the sending domain’s policy, even when the recipient uses allowlists. The most a recipient can do is pass the bounce details to the sender and suggest another way to share files in the meantime, such as a link.
How long after fixing DNS will Gmail accept my mail?
Gmail checks each message as it arrives, so the next message is judged against whatever records are visible at that moment. DNS changes take time to spread, and Google says DKIM can take up to 48 hours to start working after you add the key. Messages that already bounced are not delivered later, so resend anything important after a passing test.
Do I need DMARC if my business only sends a few emails a day?
Gmail only requires DMARC from bulk senders, those sending around 5,000 or more messages a day to personal Gmail accounts. Everyone else must pass SPF or DKIM. Google still recommends SPF, DKIM and DMARC for every domain, and a p=none record costs nothing, changes no delivery and sends reports that reveal services you forgot, or someone spoofing you.
Why do only some of my emails bounce with 5.7.26?
Different messages leave through different systems. Staff mailboxes may pass while a website form, invoicing tool or copier sending as the same domain fails. Forwarded copies can fail when the originals didn’t. Recipients matter too: Gmail’s sender requirements apply to personal Gmail accounts, so the same message can reach one address and bounce at another. The IP in the bounce, or in the Received headers of the returned message, shows which system sent it.
Is 5.7.26 the same as being blacklisted?
No. 5.7.26 is about authentication: Gmail couldn’t confirm the message came from the domain it claims. Reputation problems use other codes, such as 5.7.28 for an unusual rate of unsolicited mail from your IP, or 5.7.1 for messages blocked as likely spam. Fixing SPF, DKIM and DMARC clears 5.7.26 but won’t repair a poor sending reputation.
Does Microsoft 365 sign email with DKIM automatically?
Only for the initial onmicrosoft.com domain. Microsoft says mail from custom domains, such as your company’s own domain, isn’t DKIM signed until you publish the two CNAME records and turn on signing on the DKIM tab of Email authentication settings in the Defender portal. Until then your mail relies on SPF alone, which fails when messages are forwarded.