Bounce and error codes

550-5.7.26 This mail has been blocked because the sender is unauthenticated

Last updated 2026-08-26

Gmail uses this one code for two failures that need opposite fixes. Read the sentence after the number before you touch DNS.

Which one is in your log?

Version one, no authentication:

Nothing passed. The sending system has no working SPF for the IP it connects from, and it is not signing with DKIM. Fix the sender.

Version two, DMARC:

Here something may well have passed for the vendor's domain, but nothing aligned with yours, and your published policy said reject. Fix alignment, or fix the fact that the sender is not yours.

Diagnose version one

The bounce hands you the IP. Check whether your SPF record authorises it, and remember that a record over ten lookups authorises nothing:

Then run it through the SPF checker, which resolves the whole include chain and gives you the real lookup count. Two things show up constantly here. The sending system is a server or an app that was never added to SPF, often a monitoring box or a printer relay. Or the record is at eleven lookups and every check returns permerror.

For DKIM, open a message the system sent and look for a DKIM-Signature: header. No header means no signing, which is a setting in the sending application, not a DNS problem. If there is a header, take its s= and d= and check the key is published with the DKIM checker.

Diagnose version two

This is an alignment failure, and the tell is a delivered copy showing spf=pass and dmarc=fail in the same Authentication-Results: line. Reading that header is its own page. The short version: SPF passing for bounces.vendor.net does nothing for a message whose visible From is you@example.com.

Confirm your own policy while you are there:

Fix

1. Turn on DKIM for every system that sends as you. This is the durable fix. It survives forwarding, and it is a copy-paste of the records the provider hands you. The provider pages list what each one publishes.
2. Get SPF correct and under ten lookups. The lookup guide is the fastest way through this if you are over.
3. Publish DMARC. Start at p=none with a rua= address. It satisfies the bulk sender requirement, and the reports show you the senders you are about to break when you tighten.
4. Add a working unsubscribe and keep complaints down. Gmail's bulk sender rules include one-click unsubscribe and a spam complaint rate under 0.3%. Authenticated mail gets in the door; Gmail decides whether it stays by the complaint rate.

Retry

Fix, publish, wait out the TTL, then send one message to a Gmail address you control. Open it, use Show original, and read the SPF, DKIM and DMARC lines Gmail prints at the top. All three green means you can restart the batch. Sending the whole run to find out is how a temporary problem becomes a reputation problem, and the rate limiting page is what that looks like.

You fixed this sender. Tomorrow the reports name the other hosts still sending as you, and we turn a day of XML into one email with a verdict per sender. On the paid plans, the day a report first names a new sender failing, you hear about it. Get the weekly digest. The first domain is free.