What 550 5.7.26 means
5.7.26 is registered as 'Multiple authentication checks failed'. Gmail uses 550 5.7.26 for three related rejections: the sender is unauthenticated (neither SPF nor DKIM passed), the envelope sender's SPF record ends in -all and the sending IP isn't in it, or the message failed DMARC and the From domain's DMARC policy says to reject.
Since 2024, Gmail requires every sender to pass SPF or DKIM, and bulk senders to pass both plus DMARC. A 5.7.26 means none of your authentication held up, so nothing about content or reputation matters until it's fixed.
What the bounce looks like
The wording providers document for this code. Your bounce may add an IP address, a session ID or a help link after it.
550 5.7.26 This email has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM. Authentication results: DKIM = did not pass SPF [domain] with ip: [IP] = did not pass.550 5.7.26 The (E)MAIL FROM domain [domain] has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks with the ip: [IP]. To best protect our users from spam and phishing, the message has been blocked.550 5.7.26 Unauthenticated email from [domain] is not accepted due to domain's DMARC policy. Contact the administrator of [domain] domain if this was legitimate email.421 4.7.26 This email has been rate limited because it is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM.Temporary version: Gmail defers instead of blocking. Same fix.
Why cold emailers see 550 5.7.26
- No DKIM signing for your domain. On Google Workspace, DKIM must be generated and turned on in the Admin console; until then Google signs with a default domain that doesn't align with yours.
- SPF that doesn't include the service actually sending (for Workspace, include:_spf.google.com), or an SPF record over the 10-DNS-lookup limit, which makes it fail.
- Sending through a third-party SMTP server under your domain without adding it to SPF or setting up its DKIM.
- A DMARC policy of p=reject on a domain where some mail stream isn't aligned.
- DNS changes still propagating, or a typo in a TXT record.
How to fix 550 5.7.26
- Read the 'Authentication results' part of the bounce. It tells you whether DKIM, SPF or DMARC failed.
- Run your domain through an SPF/DKIM/DMARC checker and fix whatever fails.
- Turn on DKIM for the domain with the provider that sends your mail, publish the TXT record, and confirm a test message to Gmail shows dkim=pass with your domain.
- Make sure SPF lists every service that sends as your domain and stays under 10 lookups.
- Start DMARC at p=none until you've confirmed all mail is aligned; tighten later.
- Resend to the bounced contacts once a test email shows spf=pass, dkim=pass and dmarc=pass in Gmail's 'Show original'.
Retry or suppress?
Don't suppress the recipients. Every Gmail address will bounce the same way until authentication is fixed. Pause the campaign, fix DNS, verify with a test send, then resend.
Reading the code
The basic code 550 means "Mailbox unavailable or message refused (permanent)" under RFC 5321. In 5.7.26, the 5 is the class (permanent failure) and the 7 is the subject (security or policy). The detail number 26 is registered in RFC 3463 / the IANA registry as "Multiple authentication checks failed".
- Class 5
- Permanent failure
- Resending the same message won't work. Something about the message, the recipient or the sender has to change first.
- Subject 7
- Security or policy
- A security or policy decision: spam filtering, authentication, blocklists, permissions.
- Detail 5.7.26
- Multiple authentication checks failed
Check the rest of your setup
Run your sending domain through the SPF, DKIM & DMARC checker to see which record fails, then follow how to set up SPF, DKIM and DMARC. Paste the headers of a test message into the email header analyzer to confirm all three pass.
Got a different bounce? Paste it into the SMTP error code lookup to decode it.