Gmail 550 5.7.26: rejected by the domain’s DMARC policy

550 5.7.26Unauthenticated email rejected by the domain’s DMARC policyPermanent: retrying will not helpFrom Gmail and Google Workspace

Example
550-5.7.26 Unauthenticated email from example.com is not accepted due to domain’s DMARC policy. Please contact the administrator of example.com domain if this was a legitimate mail. - gsmtp

What it means

This variant of 5.7.26 is Gmail enforcing the DMARC record of the domain in your visible From: header. Gmail evaluated SPF and DKIM, found that neither produced a pass aligned with that From domain, then looked up _dmarc.example.com and found a policy telling receivers to refuse such mail. Gmail honours p=reject with a permanent 550, so nothing will retry.

It differs from the plain “This mail is unauthenticated” 5.7.26 text. In that case Gmail’s own baseline rule fired (no SPF or DKIM at all). Here authentication may well have passed for some domain, such as your ESP’s bounce domain, but not for the domain readers see. DMARC demands alignment, so a pass for the wrong domain does not count.

The From domain owner controls the policy, so the fix sits with whoever sends on that domain’s behalf, not with the Gmail user.

Likely causes

  • A third party (newsletter platform, CRM, ticketing tool) sends as your domain without a DKIM key published under your domain, so only its own domain is signed.
  • Mail is forwarded or passes a mailing list that rewrites the body or subject, breaking DKIM, while SPF fails because the forwarder’s IP is not in your record.
  • The DMARC record was moved to p=reject before every sending source had been inventoried from aggregate reports.
  • Strict alignment (adkim=s or aspf=s) is set, but signatures use a subdomain such as mail.example.com instead of example.com.

How to fix it

  1. Read the full bounce and the original message headers. Note the From domain, the Return-Path domain, and the d= value of any DKIM-Signature header.
  2. For each sending platform, publish the DKIM selector it gives you (usually a CNAME or TXT at selector._domainkey.example.com) and turn on signing with your domain.
  3. If the platform uses its own bounce domain, set up a custom return path under your domain so SPF also aligns, then add its include to your SPF record.
  4. Until every source is aligned, relax enforcement temporarily, for example `v=DMARC1; p=none; rua=mailto:dmarc@example.com`, and study the aggregate reports.
  5. Move back to quarantine and then reject only when the reports show all legitimate sources passing aligned DKIM.

Checks that apply

  • DMARC Check Shows the exact policy, alignment mode, and pct value that Gmail applied to your From domain.
  • DKIM Check Confirms the selector your platform signs with actually resolves to a valid public key under your domain.
  • Email Header Analyzer Paste a copy of the message to see which domains SPF and DKIM passed for and whether either one aligned.
  • DMARC Report Analyzer Parses aggregate reports so you can list every source still failing before you tighten the policy again.

The classification runs without network lookups and we never store your paste.

FAQ

Can the Gmail recipient whitelist me around a DMARC reject?
Not reliably. Gmail applies the sending domain’s published policy, and a filter or contact entry on the recipient side does not override a p=reject failure.
I am not the domain owner but I got this bounce. What now?
Contact the administrator of the From domain named in the bounce. Only they can add DKIM for the service you used or change their DMARC record.

Google Postmaster Tools Google email sender guidelines

All 191 bounce codes