Gmail 550 5.7.26: this mail is unauthenticated
550 5.7.26Unauthenticated mail blocked (no SPF or DKIM pass)Permanent: retrying will not helpFrom Gmail and Google Workspace
550-5.7.26 This mail is unauthenticated, which poses a security risk to the sender and Gmail users, and has been blocked. The sender must authenticate with at least one of SPF or DKIM. For this message, DKIM checks did not pass and SPF check for [example.com] did not pass with ip: [203.0.113.10]. - gsmtp
What it means
Since Google’s sender requirements took effect in 2024, every sender to personal Gmail accounts must pass at least SPF or DKIM, regardless of volume. This bounce says your message passed neither. Gmail names the envelope domain it tested for SPF and the connecting IP, which tells you exactly where to look.
The code is permanent. Your server will not retry, and the message is gone from the queue. The text is different from the DMARC variant of 5.7.26, where authentication may succeed but not for the visible From domain, and from 4.7.27 or 4.7.30, which are temporary deferrals aimed at bulk senders.
Likely causes
- The envelope sender domain has no SPF record, or the record does not list the IP that connected to Gmail.
- Your mail server or application does not DKIM sign at all, or signs with a selector whose public key was never published.
- Mail goes out from a new server, a cloud VM, or a backup relay that nobody added to SPF.
- An SPF record exceeds the 10 DNS lookup limit, so Gmail gets a permerror instead of a pass.
How to fix it
- Take the domain and IP printed in the bounce and run an SPF check against that pair. If the IP is missing, add it, for example `v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all`.
- Enable DKIM signing on the system that sent the message and publish its key. In Google Workspace that is Admin console, Apps, Gmail, Authenticate email.
- Keep the SPF record to a single TXT record under 10 lookups; flatten or remove unused includes.
- Send a test to a Gmail address, open Show original, and confirm SPF: PASS and DKIM: PASS before resending the bounced mail.
Checks that apply
- SPF Check Evaluates your SPF record against the sending IP Gmail printed, including lookup count and permerrors.
- DKIM Check Checks whether the selector you sign with publishes a usable key.
- Google/Yahoo Compliance Runs the full list of Gmail sender requirements so you catch PTR, TLS, and DMARC gaps at the same time.
FAQ
- Do I need both SPF and DKIM to avoid 5.7.26?
- One passing mechanism is enough to clear this particular block. Bulk senders above 5,000 daily messages to Gmail must have both, plus DMARC.
- Why did this start suddenly when nothing changed?
- Often something did change: a new sending host, an ESP migration, or an edited SPF record. Gmail also tightened enforcement in stages through 2024 and 2025.