Mail errors · Gmail

What does “550 5.7.26 Unauthenticated email from domain-name is not accepted due to domain's DMARC policy” mean?

Gmail refused a message that used your domain because it failed DMARC, and your DMARC record asks mail servers to refuse such mail.

Last read from the sources at the foot of this page.

Check my firm Read the steps
Gmail bounce
Mail Delivery Subsystem
550 5.7.26

Unauthenticated email from domain-name is not accepted due to domain's DMARC policy

As Gmail prints it.
01

What does it mean?

The message said it was from your domain. It passed neither SPF nor DKIM in a way that matches your domain, so it failed DMARC. Your DMARC record is at p=reject or p=quarantine, so Gmail refused it.

Gmail writes domain-name where the bounce you received carries your own domain.

02

What exactly does the source say?

550 5.7.26 Unauthenticated email from domain-name is not accepted due to domain's DMARC policy. Contact the administrator of domain-name domain if this was legitimate email. To learn about the DMARC initiative, go to Control unauthenticated email from your domain.

Gmail's page writes domain-name and ip-address where your bounce shows your own domain and the sending address.

03

Why would a small firm see it?

A tool that sends in your name was added without its SPF include or its DKIM record: an invoicing or accounting tool, a booking system, a newsletter tool, or your website's contact form. A forwarded message can also fail.

If nobody at your firm sent the message, the bounce is the policy doing its job: someone used your domain and Gmail refused it.

04

How do I fix it?

  1. Find which service sent the message.The bounce names it, and your DMARC reports list every address that sends as your domain.
  2. Turn on DKIM signing for your domain at that service, and publish the record it gives.

Keep one SPF record. Add the service inside the one record you have, before its last word, and keep every service already in it. A second SPF record makes the check fail for every message.

An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10 the check fails, so take out services you no longer use before adding a new one.

Do not lower the policy to p=none to stop the bounces. That also stops the protection.

Sources

Where does this come from?

Related
06 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy