550-5.7.26 unauthenticated email from domain is not accepted

TL;DR

Gmail is rejecting the mail because your domain fails authentication: publish a correct SPF record and a valid DKIM signature for the sending service. Gmail requires at least one of SPF or DKIM to pass and align with the from-domain; fixing DNS is the only fix, and no retry or resend will get through without it.

550-5.7.26 unauthenticated email from domain is not accepted

Use this when

• Gmail bounces with 550-5.7.26 mentioning unauthenticated email
• A new sending service (SES, SendGrid, Resend) starts mailing from your domain and Gmail rejects it
• Other providers deliver but Gmail rejects

Not for this skill when

• The code is 5.7.1 (relay/policy block; different cause)
• Gmail cites a blocklist or spam rate (reputation, not authentication)
• The bounce comes from Outlook, Yahoo, or another receiver

Steps

1. Read the full bounce text; Gmail's 5.7.26 names whether SPF, DKIM, or both failed. Expected: you know which mechanism to fix.
2. Check the domain's SPF TXT record at your DNS host: it must include your sending service (e.g. include:amazonses.com or include:sendgrid.net) and end with a policy like ~all. Expected: one SPF record, valid syntax.
3. Check DKIM: confirm the sending service's DKIM CNAME/TXT records are published and the service shows DKIM as verified in its dashboard. Expected: DKIM signs with your domain, not the service's default domain.
4. Verify alignment: the from-address domain must match the SPF return-path domain or the DKIM signing domain. Expected: at least one aligned pass.
5. Send a test to a Gmail address and check Authentication-Results in the headers. Expected: spf=pass and dkim=pass, and the 5.7.26 stops.

Variant phrasings

gmail 550 5.7.26 unauthenticated email

Publish SPF and DKIM for the sending service; Gmail requires aligned authentication.

gmail rejects unauthenticated email from domain

Check that DKIM signs with your domain rather than the provider's shared domain.

Tool/version compatibility

Gmail's authentication requirements as enforced since the 2024 bulk-sender rules; applies to all sending services (SES, SendGrid, Resend, Postmark, Mailgun). DNS propagation takes minutes to 48 hours.

Why it happens

Gmail rejects mail from domains that cannot prove the sender is authorized. SPF proves it by listing authorized sending IPs for the domain; DKIM proves it with a cryptographic signature tied to the domain. If neither passes and aligns with the from-domain, Gmail assumes spoofing and rejects with 5.7.26 before the message reaches the inbox or spam folder. Bulk senders (5,000+ per day to Gmail) face strict enforcement.

Edge cases / pitfalls

• Multiple SPF TXT records on one hostname break SPF entirely; merge into one record.
• DKIM via the provider's shared domain authenticates the provider, not you; set up custom DKIM signing for your domain.
• DNS caching: a corrected record can take a full TTL to be visible to Gmail; wait before retesting.
• Forwarded mail can break SPF; DKIM surviving forwarding is why both mechanisms matter.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_FeqWVsuEkN3LJLUMATlxKQ