550 5.7.26
Returned by Gmail. The wording varies between operators and versions; the code is what identifies it.
This mail has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM.
What the receiving server did
Gmail checked the domain in the From header — the address a human sees — and asked two questions about it: did SPF pass for the server that connected, and does the message carry a valid DKIM signature from that same domain?
The answer to both was no. 5.7.26 is not a spam score or a reputation problem; it is the absence of any authentication at all. Gmail applies it to bulk senders regardless of content, so a perfectly ordinary newsletter fails exactly as hard as a suspicious one.
Passing one of the two is enough for this specific rejection. Passing both, and aligning them with the From domain, is what DMARC additionally requires.
Why yours failed — in the order it is usually true
- 1
Mail is sent through a service that is not listed in your SPF record
Look at the Received header of a rejected message for the sending IP, then check whether that IP is covered by your SPF record. A new marketing tool, a CRM or a booking system added last month is the usual answer.
No SPF record found — what it means and how to fix it - 2
SPF exists but returns PermError, so it counts as no result at all
An SPF record that needs more than ten DNS lookups is invalid, and receivers treat the result as if the record were absent. Count the include: mechanisms — each one costs at least one lookup, and each nested include costs more.
SPF PermError: too many DNS lookups (the 10-lookup limit) — how to fix it - 3
DKIM is not signing, or signs with a different domain
Open a delivered message in another mailbox and read the Authentication-Results header. dkim=none means nothing was signed. dkim=pass header.d=sendgrid.net means the mail is signed, but by the provider rather than by you — which satisfies Gmail here but will fail DMARC alignment later.
DKIM selector not found — how to locate your actual selector - 4
The sending service was configured but its DNS records were never published
Most providers show a green "verified" badge only after the CNAME or TXT records exist. A half-finished setup is invisible until the first bulk send.
The record
This is the minimum for a domain that sends only through Google Workspace. Add an include: for every other service that sends on your behalf, and keep the total under ten DNS lookups. Scanning the domain below counts them for you.
Check what your domain publishes right now
Free, no signup. It counts your SPF lookups, tries 24 DKIM selectors and reads your DMARC policy, then tells you which of the causes above applies to you.