Fixing Gmail 550 5.7.26
550 5.7.26 is Gmail refusing a message because it could not authenticate it strongly enough. Mail to personal Gmail accounts must pass SPF or DKIM; bulk senders must additionally have DMARC and alignment between the authenticated domain and the visible From:. The message is rejected at SMTP — it does not land in spam, it does not arrive at all.
From:
domain, and each pass/fail. Most wasted hours on this error come from changing DNS before knowing
which of the three mechanisms actually failed.
Fix it in this order
- Identify the system that sent the rejected message. Do not add an IP to SPF merely because it appeared in a bounce — that is how records end up over the lookup limit with authorisations nobody can account for.
- Publish exactly one SPF record authorising every legitimate sender for the envelope-from domain. One record. Two is a PermError.
- Enable DKIM at the provider and confirm the selector resolves. See finding a DKIM selector.
- Confirm alignment. At least one passing mechanism must be on a domain that
aligns with the visible
From:. This is the step that is usually the actual problem. - Retest with a fresh message after DNS has propagated. Do not re-test the bounced one.
The traps
- Two SPF records — a permanent error, and easy to do by following two ESP setup guides.
- SPF passing for the ESP's domain but not aligning with yours. Passing ≠ aligning.
- A DKIM record published but the provider not actually signing outbound mail.
- Forwarding breaking SPF. Aligned DKIM is what survives this.
- Over the 10-lookup limit, so SPF PermErrors and contributes nothing — even though the record "looks fine" in a DNS console.
Check the sending domain's public records
We read public DNS. Compare what we find against the bounce's authentication results.
Primary reference
Google's email sender guidelines are the source of truth and they do change. If this page and Google disagree, Google is right.
Frequently asked
What does 550 5.7.26 mean?
Gmail could not authenticate the message. For personal Gmail accounts, mail must pass SPF or DKIM. For senders above Gmail's bulk threshold, it must also have a DMARC record and at least one authenticated domain that aligns with the visible From domain. A 550 is a hard rejection — the message is refused, not filtered.
Does 550 5.7.26 mean my email went to spam?
No, and the difference matters. 5xx is a permanent rejection at SMTP. The message never entered the mailbox at all, spam folder included. Your sending system should have received a bounce.
I have SPF, DKIM and DMARC set up and still get 550 5.7.26. Why?
Almost always alignment. SPF is checked against the envelope-from, which for most ESPs is the ESP's bounce domain, not yours — so SPF passes for them and aligns with nothing. If DKIM is also signed with the ESP's domain rather than yours, no authenticated identifier aligns with your From: domain, and DMARC fails despite all three records existing. Fix it by enabling DKIM signing on your own domain in the ESP.
Related
- Gmail bulk sender requirements — What Google requires once you cross its bulk threshold to personal Gmail accounts: authentication, alignment, DNS, TLS, spam rate and one-click unsubscribe.
- SPF PermError — PermError means SPF failed permanently — you get no authentication benefit at all.
- SPF vs DKIM vs DMARC — Three records, three different jobs.
- Yahoo sender requirements — Yahoo's bulk sender rules track Google's closely: SPF and DKIM, DMARC, alignment, low complaint rate, one-click unsubscribe.
- Outlook 550 5.7.515 and friends — Microsoft's 5.
Automate this → — free tier, public pricing, API key emailed in about thirty seconds. No call with anyone.