Is 5.7.26 always a DMARC failure?

Not by definition, but in practice it usually is. The registry name only says several checks failed; Gmail and others apply it to DMARC failures.

Can the recipient accept the mail anyway?

Their admin can add an exception, but the domain owner’s DMARC policy asked for rejection, so fixing authentication is the right path.

5.7.26 bounce: multiple authentication checks failed

5.7.26Multiple authentication checks failedPermanent: retrying will not help

Typical wording

550 5.7.26 Multiple authentication checks failed

What it means

RFC 7372 registered X.7.26, “multiple authentication checks failed”, for messages that failed more than one authentication method, for example both SPF and DKIM. A receiver uses it when no single narrower code (5.7.20 to 5.7.25) describes the problem on its own.

In practice it is closely tied to DMARC. Gmail sends 550 5.7.26 when mail fails the sender’s DMARC policy or is unauthenticated, and other receivers report DMARC rejections with it as well. Since DMARC passes when either SPF or DKIM passes with alignment, a DMARC fail means both failed or did not align.

The 4-class form 4.7.26 shows up when a receiver defers rather than rejects unauthenticated mail, which some do during a ramp-up of their requirements. With 5.7.26 the message is refused for good.

Likely causes

A new sending service using your From domain without SPF authorisation and without signing as your domain.
A DMARC policy of p=reject combined with a sender that only passes SPF for its own bounce domain, not yours.
Mail forwarded through a server that breaks DKIM and changes the IP, so both checks fail on arrival.
A domain with no SPF and no DKIM at all, sending to a receiver that requires authentication.

How to fix it

Check the Authentication-Results header of a delivered copy, or your DMARC aggregate reports, to see which of SPF and DKIM failed and which domains were checked.
Authorise every legitimate sender in SPF and turn on DKIM signing with your own domain for each one.
Make sure at least one aligns with the From domain; for DMARC, aligned DKIM is the more robust of the two.
Publish DMARC with reporting, for example `v=DMARC1; p=none; rua=mailto:dmarc@example.com`, fix what reports show, then move to quarantine or reject.

Checks that apply

Your domain or sending IP (fills in the checks below)

Domain Health Grades SPF, DKIM, DMARC and their alignment in one pass, matching the several checks a 5.7.26 covers.
DMARC Check Shows your DMARC policy and alignment modes, which decide whether the combined failure leads to rejection.
DMARC Report Analyzer Parses aggregate reports so you can see which sources fail both SPF and DKIM.
Google/Yahoo Compliance Checks the Gmail and Yahoo sender requirements that most often produce 5.7.26 refusals.

FAQ

Is 5.7.26 always a DMARC failure?: Not by definition, but in practice it usually is. The registry name only says several checks failed; Gmail and others apply it to DMARC failures.
Can the recipient accept the mail anyway?: Their admin can add an exception, but the domain owner’s DMARC policy asked for rejection, so fixing authentication is the right path.

All 191 bounce codes