Mail errors · Gmail

What does “550 5.7.26 This email has been blocked because the sender is unauthenticated” mean?

Gmail blocked the message because it passed neither SPF nor DKIM.

Last read from the sources at the foot of this page.

Check my firm Read the steps
Gmail bounce
Mail Delivery Subsystem
550 5.7.26

This email has been blocked because the sender is unauthenticated

As Gmail prints it.
01

What does it mean?

Gmail checked two things: whether the sending server is listed in your SPF record, and whether the message carried a valid DKIM signature. Both failed.

The 421 4.7.26 wording below is the same finding with a temporary limit instead of a block.

02

What exactly does the source say?

550 5.7.26 This email has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM. Authentication results: DKIM = did not pass SPF [domain-name] with ip: [ip-address] = did not pass. For instructions on setting up authentication, go to Email sender guidelines.

Gmail's page writes domain-name and ip-address where your bounce shows your own domain and the sending address.

Same fix: 421 4.7.26
421 4.7.26 This email has been rate limited because it is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM. Authentication results: DKIM = did not pass SPF domain-name with ip: ip-address = did not pass. To resolve this issue, go to Email sender guidelines.
03

Why would a small firm see it?

Your domain has no SPF record, or the service that sent this message is not in it, and the service does not sign with DKIM.

04

How do I fix it?

  1. List every service that sends mail as your domain: your mailboxes, your invoicing or accounting tool, your booking system, your newsletter tool, your website's contact form.
  2. Find each service's SPF include in its own help pages.
  3. Send yourself a message through the service and open its headers.Look for spf=pass.
  4. Turn on DKIM signing for your domain at your mail provider, and at each other service that sends as your domain.Each one gives you a record to publish.

Keep one SPF record. Add the service inside the one record you have, before its last word, and keep every service already in it. A second SPF record makes the check fail for every message.

An SPF record may make at most 10 DNS lookups. Each include counts, and so do the includes inside it. Past 10 the check fails, so take out services you no longer use before adding a new one.

05

What else do the sources say?

Starting February 1, 2024, all email senders who send email to Gmail accounts must meet the requirements in this section. Important: If you send more than 5,000 messages per day to Gmail accounts, follow the Requirements for sending 5,000 or more messages per day. Set up SPF or DKIM email authentication for your sending domains.

Messages that aren't authenticated with these methods might be marked as spam or rejected with a 5.7.26 error.

Sources

Where does this come from?

Related
07 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy