## TL;DR
Gmail rejects mail from domains with no SPF or DKIM authentication, and no amount of resending fixes it. Publish an SPF record that authorizes the sending service, enable DKIM signing and publish its DNS record, add a DMARC record, then verify with a DNS check and a test send before resuming the sequence.

## The query

```text
gmail '550-5.7.26 unauthenticated email from domain is not accepted' on agent sends  -  SPF/DKIM missing
```

## Steps

### 1. Confirm the bounce is really 5.7.26 and note the envelope domain
Read the full bounce message. Confirm the code is 550-5.7.26 and identify the envelope-from domain the agent is sending as. That domain is the one that needs DNS records.

Expected: you have the exact sending domain and the 5.7.26 code confirmed.

### 2. Publish an SPF record for the sending domain
In the domain's DNS, add a TXT record for the domain authorizing the sending service's servers. Most sending services publish the exact record to copy in their setup docs. Keep it to one SPF record per domain; multiple records break validation.

Expected: a DNS lookup of the domain's TXT records shows the SPF record.

### 3. Enable DKIM signing and publish the DKIM record
Turn on DKIM signing in the sending service, then publish the DKIM public key as the TXT record it provides. DKIM survives forwarding better than SPF and Gmail weighs it heavily.

Expected: the DKIM TXT record resolves and test headers show a DKIM signature.

### 4. Add a DMARC record starting at p=none
Publish a DMARC TXT record with a monitoring-only policy so you get aggregate reports about authentication results without rejecting mail during the fix.

Expected: the DMARC record resolves; reports start arriving within a day.

### 5. Verify, test, then resume
Wait for DNS propagation, confirm all three records with a DNS lookup tool, and send a test message to a Gmail seed inbox. Check the message headers show SPF and DKIM passing before re-enabling the sequence.

Expected: the test send lands in the inbox with SPF and DKIM marked pass.

## Use this when

- Agent sends to Gmail addresses bounce with 550-5.7.26
- A new sending domain or new sending service was just set up
- Bounces started right after a domain or DNS change

## Not for this skill when

- Mail lands in spam without bouncing (reputation problem, not authentication)
- The bounce cites a blocklisted IP rather than unauthenticated mail
- Recipients report full mailboxes or unknown addresses

## Variant phrasings

### gmail 550 5.7.26 unauthenticated email is not accepted
The same code without the hyphens. Same DNS fix.

### our domain emails bounce from gmail saying not authenticated
Operator phrasing of the same failure. Confirm the 5.7.26 code, then follow the steps.

### agent emails to gmail rejected spf dkim missing
Symptom-first phrasing. The fix is still the three DNS records.

## Why it happens
Gmail requires senders to prove they are authorized for the domain in the From header. Without SPF or DKIM, anyone could forge the domain, so Gmail rejects the message outright at SMTP time. Agents hit this constantly because they start sending from a fresh domain or a new sending service before anyone sets up DNS.

## Edge cases

- A subdomain needs its own SPF record or an SPF setup that covers it. Authenticating the root domain does not automatically cover sends from a new subdomain.
- More than one SPF TXT record on a domain causes a permanent SPF error. Merge includes into a single record.
- DNS changes can take hours to propagate. Verify with a lookup before declaring the fix failed.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_e2n01Dp7NFaJkVYx6zLkdw