Gmail 550 5.7.26: this mail is unauthenticated
By Jose Pollman · Published
The error
550-5.7.26 This mail has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM.
550 5.7.26 Unauthenticated email from example.com is not accepted due to domain's DMARC policy.What it means
Gmail rejected the message because it could not verify that you sent it. Gmail requires every sender to pass either SPF or DKIM, aligned with the domain in your From address, and this message passed neither.
Your mail is not proving it came from you. SPF, DKIM or DMARC is missing or failing.
Why it happens
Almost always a domain sending through a service that was never authorised. A new CRM, an invoicing tool or a form handler starts sending as you, its IP is not in your SPF record and it is not DKIM-signing with your domain, so Gmail sees mail claiming to be from you with nothing to back it up. It became a hard failure for bulk senders in 2024; before that the same mail was merely more likely to land in spam.
How to fix it
- Find which system sent the message — the Received headers or the Return-Path will name it.
- Add that sender to your SPF record, or better, have it DKIM-sign with your own domain.
- Check alignment: passing SPF for the vendor's own domain does not help. The domain that passes must match the domain in your From address.
- Publish DMARC at p=none with a rua address so you find the next unauthorised sender before Gmail does.
Official documentation: Google: Gmail SMTP error codes.
Related guides
- Gmail 550 5.7.25: the sending IP has no PTR record — Gmail blocked the message because the IP it arrived from has no reverse DNS record, or the record it has does not resolve back to that same IP.
- Gmail 4.7.28: temporarily rate limited — Gmail has seen an unusual volume from your IP and is throttling it. This is temporary and the mail is not lost — your server should retry.
- 5.7.509: rejected by the DMARC policy — The From domain publishes a DMARC policy of reject or quarantine, and this message did not pass an aligned SPF or DKIM check, so the receiver honoured that policy.