DEV Community

Mogley1011
Mogley1011

Posted on Originally published at email-fix-pack.pages.dev

Gmail 550 5.7.26 "unauthenticated sender": what it means and how to fix it

#email #security #dns #devops

If Gmail bounced your message with 550 5.7.26 This message does not have authentication information or fails to pass authentication checks, it is not a content problem. Gmail is telling you it could not verify who sent the mail. Here is how to find which check failed and fix it, in the order I would do it.

1. Read the bounce, then the headers

The bounce text names the failing mechanism. Look for "SPF", "DKIM" or "DMARC" in it. If you can get a delivered copy (send to a Gmail address you control that is not blocked), open "Show original" and read the Authentication-Results line:

Enter fullscreen mode Exit fullscreen mode

You need SPF or DKIM to pass, and for bulk senders both, and DMARC to pass with alignment. Anything else is what to fix.

2. SPF: one record, under 10 lookups

Check what you publish:

dig +short TXT yourdomain.com | grep spf1
Enter fullscreen mode Exit fullscreen mode

Common faults:

  • Two SPF records. There must be exactly one v=spf1 TXT record. Merge them into one.
  • More than 10 DNS lookups. Every include:, a, mx and redirect counts. Over 10 gives permerror, which Gmail treats as a fail. Remove providers you no longer use.
  • Sending service missing. If your newsletter or invoicing tool sends as your domain, its include: must be in the record.
  • Ending in +all or nothing. Use ~all while you test and -all once you are sure.

3. DKIM: sign with your own domain

Gmail wants DKIM signed with a domain that matches your From address. Enable DKIM in your mail provider and publish the CNAME or TXT record it gives you, then confirm the selector resolves:

dig +short TXT selector1._domainkey.yourdomain.com
Enter fullscreen mode Exit fullscreen mode

A signature from the sender's own domain (for example a shared d=sendgrid.net) passes DKIM but will not align with your From domain, so DMARC still fails.

4. DMARC: publish it and make it align

Add a TXT record at _dmarc.yourdomain.com. Start in monitoring mode:

Enter fullscreen mode Exit fullscreen mode

Read the aggregate reports for a couple of weeks, fix any legitimate sender that fails, then move to p=quarantine and later p=reject. Google's bulk-sender rules (more than 5,000 messages a day to Gmail) require DMARC, and it is the right baseline for everyone.

5. Test after DNS settles

DNS changes can take up to an hour to be seen everywhere. Send a test to a Gmail address and check Authentication-Results again. If dmarc=pass and the bounce is gone, you are done.

If you do not want to work through this by hand

I built a free checker that reads your domain's live SPF, DKIM and DMARC and lists what is wrong. A paid fix pack generates the exact records for your mail provider and DNS host. Both are on Email Fix Pack (disclosure: I made it). The error is covered in more detail on this page.

Top comments (0)