Mail errors · Gmail

What does “550 5.7.26 The (E)MAIL FROM domain [domain-name] has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks” mean?

Your SPF record ends in -all, which tells mail servers to fail any server it does not list, and the server that sent this message is not listed.

Last read from the sources at the foot of this page.

Check my firm Read the steps
Gmail bounce
Mail Delivery Subsystem
550 5.7.26

The (E)MAIL FROM domain [domain-name] has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks

As Gmail prints it.
01

What does it mean?

The (E)MAIL FROM domain is the address the sending server gives for bounces. Its SPF record ends in -all, so a server not in the record gets a fail, and Gmail blocked the message.

02

What exactly does the source say?

550 5.7.26 The (E)MAIL FROM domain [domain-name] has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks with the ip: [ip-address]. To best protect our users from spam and phishing, the message has been blocked. For more information, go to Email sender guidelines.

Gmail's page writes domain-name and ip-address where your bounce shows your own domain and the sending address.

03

Why would a small firm see it?

A new service started sending as your domain, or a service changed the servers it sends from, and the SPF record was not updated.

04

How do I fix it?

  1. List every service that sends mail as your domain: your mailboxes, your invoicing or accounting tool, your booking system, your newsletter tool, your website's contact form.
  2. Find each service's SPF include in its own help pages.
  3. Send yourself a message through the service and open its headers.Look for spf=pass.

Keep one SPF record. Add the service inside the one record you have, before its last word, and keep every service already in it. A second SPF record makes the check fail for every message.

An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10 the check fails, so take out services you no longer use before adding a new one.

05

What else do the sources say?

possible qualifiers, and the results they cause check_host() to return, are as follows: "+" pass "-" fail "~" softfail "?" neutral

Sources

Where does this come from?

Related
07 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy