gmail '550-5.7.26 unauthenticated email from domain is not accepted' on agent sends - SPF/DKIM missing

TL;DR

Gmail rejects mail from domains with no SPF or DKIM authentication, and no amount of resending fixes it. Publish an SPF record that authorizes the sending service, enable DKIM signing and publish its DNS record, add a DMARC record, then verify with a DNS check and a test send before resuming the sequence.

The query

gmail '550-5.7.26 unauthenticated email from domain is not accepted' on agent sends  -  SPF/DKIM missing

Steps

1. Confirm the bounce is really 5.7.26 and note the envelope domain

Read the full bounce message. Confirm the code is 550-5.7.26 and identify the envelope-from domain the agent is sending as. That domain is the one that needs DNS records.

Expected: you have the exact sending domain and the 5.7.26 code confirmed.

2. Publish an SPF record for the sending domain

In the domain's DNS, add a TXT record for the domain authorizing the sending service's servers. Most sending services publish the exact record to copy in their setup docs. Keep it to one SPF record per domain; multiple records break validation.

Expected: a DNS lookup of the domain's TXT records shows the SPF record.

3. Enable DKIM signing and publish the DKIM record

Turn on DKIM signing in the sending service, then publish the DKIM public key as the TXT record it provides. DKIM survives forwarding better than SPF and Gmail weighs it heavily.

Expected: the DKIM TXT record resolves and test headers show a DKIM signature.

4. Add a DMARC record starting at p=none

Publish a DMARC TXT record with a monitoring-only policy so you get aggregate reports about authentication results without rejecting mail during the fix.

Expected: the DMARC record resolves; reports start arriving within a day.

5. Verify, test, then resume

Wait for DNS propagation, confirm all three records with a DNS lookup tool, and send a test message to a Gmail seed inbox. Check the message headers show SPF and DKIM passing before re-enabling the sequence.

Expected: the test send lands in the inbox with SPF and DKIM marked pass.

Use this when

• Agent sends to Gmail addresses bounce with 550-5.7.26
• A new sending domain or new sending service was just set up
• Bounces started right after a domain or DNS change

Not for this skill when

• Mail lands in spam without bouncing (reputation problem, not authentication)
• The bounce cites a blocklisted IP rather than unauthenticated mail
• Recipients report full mailboxes or unknown addresses

Variant phrasings

gmail 550 5.7.26 unauthenticated email is not accepted

The same code without the hyphens. Same DNS fix.

our domain emails bounce from gmail saying not authenticated

Operator phrasing of the same failure. Confirm the 5.7.26 code, then follow the steps.

agent emails to gmail rejected spf dkim missing

Symptom-first phrasing. The fix is still the three DNS records.

Why it happens

Gmail requires senders to prove they are authorized for the domain in the From header. Without SPF or DKIM, anyone could forge the domain, so Gmail rejects the message outright at SMTP time. Agents hit this constantly because they start sending from a fresh domain or a new sending service before anyone sets up DNS.

Edge cases

• A subdomain needs its own SPF record or an SPF setup that covers it. Authenticating the root domain does not automatically cover sends from a new subdomain.
• More than one SPF TXT record on a domain causes a permanent SPF error. Merge includes into a single record.
• DNS changes can take hours to propagate. Verify with a lookup before declaring the fix failed.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_e2n01Dp7NFaJkVYx6zLkdw