Gmail 550 5.7.26 'Sender Is Unauthenticated': Causes and the Fix for Each

550 5.7.26 This email has been blocked because the sender is unauthenticated means Gmail rejected your message because it failed authentication. It is not about the recipient's address: the same lead will accept your mail once your sending domain passes. Gmail uses 5.7.26 for three different failures, and the text tells you which: neither SPF nor DKIM passed, the envelope domain's SPF record hard-fails, or the From domain's DMARC policy says reject. In almost every case, one sending service is not set up for your domain. Find it, make it sign DKIM with your domain, and the rejections stop.

The three versions

From Google's Gmail SMTP errors and codes page (last updated 26 October 2026, read 2 November 2026):

Message text	What failed	Most likely cause
"This email has been blocked because the sender is unauthenticated."	Neither SPF nor DKIM passed	A service sending as your domain without being authorised
"The (E)MAIL FROM domain [domain] has an SPF record with a hard fail policy (-all)..."	SPF failed and the record says -all	The sending server's IP is not in your SPF record
"Unauthenticated email from [domain] is not accepted due to domain's DMARC policy."	DMARC failed and the policy is reject	SPF or DKIM passed for a different domain, so nothing aligned

The temporary version is 421 4.7.26: "This email has been rate limited because it is unauthenticated." Gmail defers before it rejects. If you are seeing 4.7.26, fix it now, before it becomes 5.7.26.

Related codes have their own numbers: 5.7.27 for SPF failing, 5.7.30 for DKIM failing, 5.7.40 for a missing DMARC record, and 4.7.32 for a From header that is not aligned. Our Gmail bounce codes reference lists them all.

What Gmail requires

Google's sender guidelines say that since 1 February 2024 all senders to Gmail accounts must authenticate with SPF or DKIM. Bulk senders, those sending around 5,000 or more messages a day to Gmail, must have SPF, DKIM and DMARC, with the From domain aligned. Google's FAQ adds that the 5,000 count is per primary domain, including subdomains, and that since November 2025 Gmail has been "ramping up its enforcement on non-compliant traffic."

Requirement	All senders	Bulk senders
SPF or DKIM passes	Required	Both required
DMARC record	Recommended	Required, p=none is enough
From domain aligned with SPF or DKIM	Recommended	Required
PTR record for sending IPs	Required	Required
TLS	Required	Required

Our Gmail and Yahoo bulk sender requirements post covers the rest of the list, including one-click unsubscribe.

Find the failing service

The rejected message came from somewhere specific. Work out where.

1. Look at the bounce. It usually quotes the IP that connected to Gmail. Run it through the reverse DNS lookup to see whose server it is.
2. Check what changed. A new cold email platform, a new CRM sequence, an email forward, a website form or a billing tool sending as your domain are the usual suspects.
3. Send a test from that service to a Gmail address you control, open the message, choose Show original, and read the SPF, DKIM and DMARC lines. Our email headers explained guide shows what each line means, or paste the headers into the email header analyzer.

What "Show original" says	What it means	Fix
SPF: FAIL, DKIM: none	The service is not in SPF and does not sign	Set up DKIM for the service, and add it to SPF
SPF: PASS for another domain, DKIM: PASS for another domain, DMARC: FAIL	The service authenticates as itself, not you	Configure a custom DKIM domain (your domain) in the service
SPF: SOFTFAIL or FAIL, DKIM: PASS for your domain, DMARC: PASS	Fine, despite the SPF result	Nothing urgent; tidy SPF later
DKIM: FAIL (body hash)	Something changed the message after signing	Look for footers or forwarding that alter the message

Fix it, in order

1. Make the service sign DKIM with your domain

DKIM is the more robust fix because it survives forwarding and does not depend on the sending IP. Every serious sending tool lets you add your domain and publish its DKIM key. For mailboxes, see Google Workspace DKIM setup or Microsoft 365 DKIM setup. Confirm the key is live with the DKIM checker.

2. Add the service to SPF, carefully

Add the service's include: to your SPF record if it sends with your domain in the envelope. SPF has a hard limit of 10 DNS lookups, so adding includes without counting can break SPF for everything. Check the record with the SPF checker and the count with the SPF lookup counter. If you are over, our SPF too many DNS lookups guide shows the options.

3. Publish DMARC, starting at p=none

If the domain has no DMARC record, publish v=DMARC1; p=none; rua=mailto:you@yourdomain.com. That meets Gmail's bulk sender requirement without rejecting anything, and the reports show you every service sending as your domain. The DMARC generator builds the record and the DMARC checker confirms it.

4. Check alignment

DMARC passes only if SPF or DKIM passes for the same domain as the From address. A tool that signs with its own domain passes DKIM but fails DMARC. The DMARC alignment checker shows whether yours line up.

5. Resend once, not in bulk

5.7.26 is permanent, so the rejected messages will not retry. When a test message passes, resend to the leads that were rejected, at normal pace.

Cold email specifics

• Each sending domain needs its own setup. If you use several secondary domains, each one needs SPF, DKIM and DMARC, not only the main domain.
• The platform's default domain is not yours. Many cold email tools send with their own envelope domain until you configure a custom one, which can fail DMARC alignment.
• Do not delete the leads. A 5.7.26 says nothing about the address. If your sequencer auto-suppresses on any 5xx, check that these leads were not removed.
• Check after any DNS change. Moving DNS hosts or adding a service is when records get lost.

Quick checks for common setups

You send from	What usually fixes 5.7.26
Google Workspace inboxes	Turn on DKIM signing in the Admin console and publish the key; SPF should include _spf.google.com
Microsoft 365 inboxes	Enable DKIM for the custom domain (two CNAME records); SPF should include spf.protection.outlook.com
A cold email platform over SMTP	Usually inherits your mailbox's authentication; check the platform is not rewriting the envelope sender
A marketing or CRM platform	Add your domain in the platform and publish its DKIM records, plus a custom return-path if offered
A website form or app	Send through a transactional provider set up for your domain, not the web server's own mail
A forward to Gmail	SPF breaks on forwarding; DKIM usually survives, so make sure the original mail is DKIM-signed

Where SimpleVerifier fits

Verification does not touch your authentication, and 5.7.26 is not a list problem. Once your domain passes, verification takes care of the other kind of rejection, the address that does not exist. SimpleVerifier runs a live mailbox check on each address and returns safe to send, send with care, check again later or do not send, with the reason. Catch-alls stay risky, never guessed valid.

The free bulk sender checker tests a domain against Google's requirements with no account. For lists, the first 100 checks are free with a Google sign-in on the verify page, and Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off. See pricing.