Short answer
550 5.7.26 means the message failed the receiver's authentication checks. RFC 7372 defines X.7.26 as "multiple authentication checks failed". Gmail uses it for three cases: the sender is unauthenticated (no passing SPF or DKIM), the envelope sender's SPF record hard-fails (-all) for the sending IP, or the From domain's DMARC policy says to reject unauthenticated mail.
The fix is DNS: publish SPF and DKIM for the domain you send from, make sure at least one of them aligns with your From domain so DMARC passes, then send again. Don't suppress the address; it's fine.
On this page
What 550 5.7.26 means
Receivers check three things on every message. SPF: is the sending IP allowed to send for the envelope (return-path) domain? DKIM: is there a valid signature from a domain? DMARC: did SPF or DKIM pass for a domain that matches the visible From address, and what does that domain's owner want done if not?
Since 2024, Gmail requires every sender to pass SPF or DKIM, and bulk senders to pass both plus DMARC. Mail that doesn't meet the bar can be refused with 550 5.7.26; Gmail also uses 550 5.7.27 when a bulk sender fails SPF.
Common causes, by receiver
| Receiver | Code and text | Cause |
|---|---|---|
| Gmail | 550 5.7.26 "This email has been blocked because the sender is unauthenticated" | Neither SPF nor DKIM passed. |
| Gmail | 550 5.7.26 "The (E)MAIL FROM domain ... has an SPF record with a hard fail policy (-all)" | The sending IP isn't in the return-path domain's SPF record, and the record ends in -all. |
| Gmail | 550 5.7.26 "Unauthenticated email from [domain] is not accepted due to domain's DMARC policy" | DMARC failed and the From domain publishes p=reject (or p=quarantine). |
| Outlook.com | 550 5.7.515 "Access denied, sending domain ... does not meet the required authentication level" | Microsoft's equivalent for senders of 5,000+ messages a day to its consumer mailboxes: SPF and DKIM must pass, and a DMARC record must exist and pass. |
| Microsoft 365 | 550 5.7.509 "sending domain ... does not pass DMARC verification and has a DMARC policy of reject" | DMARC failed for a p=reject domain. |
| Yahoo | 553 or 554 with an authentication reason | Yahoo lists DMARC and DKIM failures among its permanent rejections. |
From Google's Gmail SMTP error reference, Microsoft's 5.7.515 article, Microsoft's NDR reference and Yahoo's SMTP error codes.
How to fix it as a sender
- 1
Find out which check failed
Open a delivered copy (or the bounce) in the email header analyzer and read
Authentication-Results: it showsspf=,dkim=anddmarc=with the domains checked. - 2
Fix SPF
Your return-path domain's SPF record must include every service that sends for it. Check it with the SPF checker. Keep to one SPF record and under 10 DNS lookups, or you get a PermError instead.
- 3
Fix DKIM
Publish the DKIM key your provider gives you and confirm it with the DKIM checker. DKIM signed with your own domain is what survives forwarding.
- 4
Make DMARC pass
DMARC needs SPF or DKIM to pass for a domain aligned with your From address. Mail signed only by your provider's domain passes DKIM but fails DMARC. Check your policy with the DMARC checker; start at
p=nonewhile you fix things.
Retry or suppress?
How Groundmail handles 550 5.7.26
Groundmail reads the receiver's whole reply, not only the code. When a 550 5.7.26 reply says the refusal is about the sender (a blocklist listing, a reputation or spam-policy block, or Gmail's authentication and unsolicited-mail refusals), the bounce is recorded with bounce_type: "block". The address is fine, so it is not suppressed and the bounce doesn't count toward your bounce rate; you can send to it again once the cause is fixed. The receiver's reply is in bounce_reason on the email and on the email.bounced or email.failed webhook, so you can see exactly what it said.
Blocks on our shared IPs are our job: we monitor the pool and its listings and work with mailbox providers and blocklist operators to clear them. Blocks caused by your own domain (missing authentication, a DMARC policy your mail fails) need a DNS fix on your side, and the domain page in the dashboard shows the status of each record.
On Groundmail this rarely happens once a domain is verified: we give you the exact SPF, DKIM and return-path records, sign every message with your domain's own DKIM key, and won't send from a domain until its records check out. The SPF, DKIM and DMARC guide explains the setup in detail.
Frequently asked questions
Why does Gmail say my email is unauthenticated when I have an SPF record?
SPF is checked against the return-path (envelope) domain, not the From domain, and it has to list the IP that actually sent the message. If your provider uses its own return-path, your SPF record doesn't apply; DKIM signed with your domain is what makes DMARC pass.
Do I need DMARC to avoid 550 5.7.26?
Gmail requires all senders to pass SPF or DKIM, and senders of more than 5,000 messages a day to Gmail to also publish DMARC. Publishing DMARC at p=none is low-risk and gives you reports on what's failing.
Is 550 5.7.26 a hard bounce?
It's permanent for that message, but it's a block caused by the sender's domain setup, not a bad address. Fix authentication and the same address will accept mail.
What's the difference between a soft bounce and a hard bounce?
A soft bounce is a temporary failure, usually a 4xx reply (mailbox busy, rate limited, try again later); the sending server retries it. A hard bounce is a permanent failure, a 5xx reply, where retrying the same message won't help. Among hard bounces, it matters whether the problem is the address (unknown user: suppress it) or the sender (a block: fix the cause, keep the address).
Sources
Facts on this page about other companies' products, prices and policies come from these public pages. They change, so check them before you decide.