What 550 5.7.26 means
A 550 5.7.26 bounce means the receiving server refused your message because it could not authenticate it. The basic code 550 is a permanent failure, so the sending server stops retrying. In the enhanced status code (RFC 3463), class 5 is permanent, subject 7 is security or policy, and detail 26 was added by RFC 7372 for "multiple authentication checks failed", in practice SPF, DKIM and DMARC.
Gmail is the receiver you will see it from most. Its bounces come in two common forms:
550-5.7.26 This mail has been blocked because the sender is unauthenticated.
550-5.7.26 Gmail requires all senders to authenticate with either SPF or DKIM.
550-5.7.26 Unauthenticated email from example.com is not accepted due to
550-5.7.26 domain's DMARC policy.
The first says neither SPF nor DKIM passed. The second says the message failed DMARC and the domain's own policy (p=reject, or p=quarantine in some cases) told the receiver to refuse it. Other providers use the same code with their own wording.
Common causes
- The sending service is not in your SPF record. You started sending through a newsletter tool, CRM or helpdesk and never added its
include:. - DKIM is not set up for the service, so it signs with its own domain (or not at all) instead of yours.
- No alignment. SPF passes for the service's bounce domain and DKIM passes for its own domain, but neither matches your From domain, so DMARC fails.
- Forwarding. A forwarder resends your message from its own IP, which breaks SPF. If DKIM is missing or the forwarder changed the body, nothing passes.
- A broken SPF record: more than 10 DNS lookups or two SPF records both make SPF return an error.
- An expired or rotated DKIM key whose selector no longer exists in DNS.
How to fix it
- Read the bounced message's headers. Paste them into the Email Header Analyzer and look at
Authentication-Results. It shows which check failed and for which domain:
Authentication-Results: mx.google.com;
dkim=none;
spf=softfail (domain of bounce@example.com does not designate 203.0.113.25 as permitted sender);
dmarc=fail (p=REJECT) header.from=example.com
- Authorize every sender in SPF. One record per domain, with each service's include:
example.com. IN TXT "v=spf1 include:_spf.google.com include:mail.example.net -all"
- Turn on DKIM signing with your domain in every service that sends as you, and publish the selector record it gives you:
s1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
- Check DMARC alignment. At least one of SPF or DKIM must pass for a domain that matches the From address. DKIM is the one that survives forwarding, so make sure it aligns.
- Resend. A 550 is final, so the original message will not be retried. Once the records are fixed and DNS has updated, send it again.
If you are tightening DMARC, start from p=none and move to p=reject only after reports show every legitimate source passing.
Related
- DMARC fail: reading a failed DMARC result.
- DMARC alignment: why SPF can pass and DMARC still fail.
- Gmail and Yahoo sender requirements: the rules behind this bounce.
- 550 5.7.515: Microsoft's equivalent for high-volume senders.
Run your sending domain through the Email Checker to see its SPF, DKIM and DMARC records in one place.