Gmail 550 5.7.26: “sender is unauthenticated” / DMARC policy

Short answer: Gmail rejected the message because neither SPF nor DKIM passed for the domain in your From address. Fix: add the sending service to your one SPF record, turn on DKIM with your own domain, and keep DMARC at p=none until every sender passes.

The bounce looks like this
550-5.7.26 This email has been blocked because the sender is unauthenticated.
550-5.7.26 Unauthenticated email from yourdomain.com is not accepted due to domain's DMARC policy.
550-5.7.26 … has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks

What it means

Gmail could not authenticate the message: neither SPF nor DKIM passed for your domain, or they passed for a different domain than the one in the From address, and your DMARC policy (or Gmail's own sender rules) says to reject it. This is a permanent bounce – resending the same way will fail again.

How to fix it

  1. Run the checker below and look at SPF, DKIM and DMARC for the domain in your From address.
  2. Make sure the service that sent the bounced message (your mailbox, CRM, newsletter or store app) is in your SPF record – build one with the SPF generator. Keep exactly one SPF record.
  3. Turn on DKIM signing in that service with your own domain (not the service's default domain) and publish the CNAME/TXT records it gives you.
  4. If the third bounce line appears, your SPF ends in -all and the sending IP is missing from it: add the sender, or use ~all until the list is complete.
  5. If you just moved DMARC to p=reject or p=quarantine, step back to p=none until every sender passes.

Check your domain now

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.

Other bounce errors