SMTP 550 5.7.26
blocked, sender unauthenticated (Gmail)
SMTP 550 5.7.26 is Gmail rejecting mail that failed authentication. Google uses it when the sender passes neither SPF nor DKIM, when SPF hard-fails, and when the message fails the sending domain's DMARC policy. Gmail requires authentication for all senders, so this is blocked until your records are fixed.
Should you remove the address?
Keep the address; fix the sending side
Keep it. The rejection is about how your message was authenticated.
Block. Retrying changes nothing until the cause on your side is fixed.
How it appears
550 5.7.26 This mail has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM.
550 5.7.26 Unauthenticated email from example.com is not accepted due to domain's DMARC policy.
550 5.7.26 The MAIL FROM domain [example.com] has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks with the ip: [203.0.113.5].
What causes it
- Neither SPF nor DKIM passed for the message.
- The domain's SPF record ends in -all and the sending IP is not listed.
- DMARC failed and the domain publishes p=reject or p=quarantine.
- A sending tool sends as your domain without DKIM signing set up.
How to fix it
In order — try the first one first.
- Set up DKIM signing for every service that sends as your domain.
- Add each sending service to SPF and keep the record under 10 DNS lookups.
- Make sure the domain in the From header aligns with the SPF or DKIM domain, so DMARC passes.
- Run a domain audit to confirm SPF, DKIM and DMARC pass before sending again.
Who sends it
Gmail and Google Workspace.
Gmail
Reply text This email has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM.
Neither SPF nor DKIM passed.
Gmail
Reply text Unauthenticated email from <domain> is not accepted due to domain's DMARC policy.
DMARC failed and the From domain publishes a policy that asks for rejection.
Gmail
Reply text The (E)MAIL FROM domain <domain> has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks with the ip: <address>.
The sending IP isn't in the SPF record, and the record ends in -all.
Common questions
- What does SMTP 550 5.7.26 mean?
- SMTP 550 5.7.26 is Gmail rejecting mail that failed authentication. Google uses it when the sender passes neither SPF nor DKIM, when SPF hard-fails, and when the message fails the sending domain's DMARC policy. Gmail requires authentication for all senders, so this is blocked until your records are fixed.
- Should I retry a 550 5.7.26 error?
- No. 550 is a permanent failure, so the message will never be delivered no matter how many times you try. Remove the address — repeated sends to permanent failures are one of the main signals mailbox providers use to throttle a sender.
- How do I fix SMTP 550 5.7.26?
- Set up DKIM signing for every service that sends as your domain.
- Is 550 5.7.26 a hard bounce or a soft bounce?
- 550 5.7.26 is a block rather than a classic hard or soft bounce. The rejection is about your sending (authentication, reputation, content or the recipient's policy), not about whether the address exists. Retrying changes nothing until the cause on your side is fixed.
- Should I remove the address after a 550 5.7.26 bounce?
- Keep it. The rejection is about how your message was authenticated.
- Will verifying my list prevent 550 5.7.26?
- Not directly. This code is about your authentication, IP or domain reputation, so verification will not lift it. A clean list still matters, because mailbox providers weigh how often a sender hits addresses that don't exist.
Clean the list before the next send.
A bounce report only tells you about the addresses you already mailed. The rest of the list has the same kinds of dead mailboxes in it, and each one becomes a hard bounce recorded against your domain the moment you send.
- A real SMTP mailbox check on every row, before anything is sent
- Dead and mistyped addresses split out, so they never reach your sending tool
- Catch-all, disposable and role addresses flagged alongside
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.
Other 550 replies
- 550 5.1.1 — mailbox does not exist
- 550 5.7.1 — message refused by policy
- 550 5.4.1 — recipient address rejected, access denied
- 550 5.2.1 — mailbox disabled, not accepting messages
- 550 — mailbox unavailable
- 550 5.1.0 — address rejected, other address status
- 550 5.1.10 — recipient not found (Microsoft 365)
- 550 5.1.8 — bad outbound sender (Microsoft 365)
- 550 5.4.5 — daily sending limit exceeded (Gmail)
- 550 4.4.7 — message expired in the queue
- 550 5.7.25 — no PTR record for sending IP (Gmail)
- 550 5.7.27 — SPF authentication failed (Gmail)
- 550 5.7.28 — unusual rate of unsolicited mail (Gmail)
- 550 5.7.23 — SPF violation (Microsoft 365)
- 550 5.7.124 — sender not in allowed senders list (Microsoft 365)
- 550 5.7.509 — DMARC failed, policy reject (Microsoft 365)
- 550 5.7.606-649 — banned sending IP (Microsoft)
- 550 5.7.705 — tenant has exceeded threshold (Microsoft 365)
- 550 5.7.708 — traffic not accepted from this IP (Microsoft 365)
- 550 5.7.750 — blocked from sending from unregistered domains (Microsoft 365)
- 550 5.7.515 — authentication required for high-volume senders (Outlook.com)
- 550 5.7.1 S3140 — IP range on Outlook.com block list
- 550 5.5.0 — Mailbox unavailable (Outlook.com, Hotmail)
- 550 5.7.12 — Sender not authenticated by organization (Microsoft 365)
- 550 5.7.513 — Blocked by the recipient's own block list (Microsoft 365)
Sources
- Source: Google Workspace Admin Help: Gmail SMTP errors and codes
- Source: RFC 3463: Enhanced Mail System Status Codes
Provider wording is quoted only where the provider publishes it.
Last reviewed 2026-10-22