## TL;DR
Gmail is rejecting the mail because your domain fails authentication: publish a correct SPF record and a valid DKIM signature for the sending service. Gmail requires at least one of SPF or DKIM to pass and align with the from-domain; fixing DNS is the only fix, and no retry or resend will get through without it.

```text
550-5.7.26 unauthenticated email from domain is not accepted
```

## Use this when
- Gmail bounces with 550-5.7.26 mentioning unauthenticated email
- A new sending service (SES, SendGrid, Resend) starts mailing from your domain and Gmail rejects it
- Other providers deliver but Gmail rejects

## Not for this skill when
- The code is 5.7.1 (relay/policy block; different cause)
- Gmail cites a blocklist or spam rate (reputation, not authentication)
- The bounce comes from Outlook, Yahoo, or another receiver

## Steps
1. Read the full bounce text; Gmail's 5.7.26 names whether SPF, DKIM, or both failed. Expected: you know which mechanism to fix.
2. Check the domain's SPF TXT record at your DNS host: it must include your sending service (e.g. include:amazonses.com or include:sendgrid.net) and end with a policy like ~all. Expected: one SPF record, valid syntax.
3. Check DKIM: confirm the sending service's DKIM CNAME/TXT records are published and the service shows DKIM as verified in its dashboard. Expected: DKIM signs with your domain, not the service's default domain.
4. Verify alignment: the from-address domain must match the SPF return-path domain or the DKIM signing domain. Expected: at least one aligned pass.
5. Send a test to a Gmail address and check Authentication-Results in the headers. Expected: spf=pass and dkim=pass, and the 5.7.26 stops.

## Variant phrasings
### gmail 550 5.7.26 unauthenticated email
Publish SPF and DKIM for the sending service; Gmail requires aligned authentication.
### gmail rejects unauthenticated email from domain
Check that DKIM signs with your domain rather than the provider's shared domain.

## Tool/version compatibility
Gmail's authentication requirements as enforced since the 2024 bulk-sender rules; applies to all sending services (SES, SendGrid, Resend, Postmark, Mailgun). DNS propagation takes minutes to 48 hours.

## Why it happens
Gmail rejects mail from domains that cannot prove the sender is authorized. SPF proves it by listing authorized sending IPs for the domain; DKIM proves it with a cryptographic signature tied to the domain. If neither passes and aligns with the from-domain, Gmail assumes spoofing and rejects with 5.7.26 before the message reaches the inbox or spam folder. Bulk senders (5,000+ per day to Gmail) face strict enforcement.

## Edge cases / pitfalls
- Multiple SPF TXT records on one hostname break SPF entirely; merge into one record.
- DKIM via the provider's shared domain authenticates the provider, not you; set up custom DKIM signing for your domain.
- DNS caching: a corrected record can take a full TTL to be visible to Gmail; wait before retesting.
- Forwarded mail can break SPF; DKIM surviving forwarding is why both mechanisms matter.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_FeqWVsuEkN3LJLUMATlxKQ