550 5.7.26 — Unauthenticated email is not accepted due to DMARC policy (Gmail)
Retrying will not help. The message will not be delivered.
The reply
550 5.7.26 Unauthenticated email from <domain> is not accepted due to domain's DMARC policy.Gmail could not authenticate the message, and the domain in the From: header publishes a DMARC policy telling receivers to reject exactly that. Your own DNS asked for this rejection — which is good news, because it means you control both halves of the fix.
What it means
Two things have to be true for this reply. First, both SPF and DKIM failed to produce an aligned pass: either neither passed, or one passed for a domain other than the one in the visible From:. Second, that From: domain publishes p=reject or p=quarantine. Gmail is enforcing your own stated policy. Since 2024 Google also requires authentication from every sender to Gmail regardless of your DMARC record, so this is not a rule you can opt out of by relaxing your policy.
Why it happens
- SPF passes for the envelope sender's domain but the visible From: is a different domain — a pass without alignment does not count.
- DKIM is not configured, or the signature is d= a domain that does not align with the From:.
- Sending through a service that was never listed in your SPF record.
- An SPF record over the ten-DNS-lookup limit, returning permerror and so failing everywhere at once.
- A forwarder or mailing list modified the message and broke the DKIM signature, with no ARC chain to vouch for the original result.
What to do
- Sign with DKIM using a key whose d= is the From: domain. This is the fix that also survives forwarding, so do it first.
- Align SPF too: the envelope sender's domain should be the From: domain or a subdomain of it.
- Check the SPF record's lookup count — over ten it is permerror and nothing passes, however correct the record reads.
- Read your DMARC aggregate reports. They name every source failing authentication, which is usually a service you forgot was sending as you.
- Do not relax DMARC to work around it. Google requires authentication from bulk senders to Gmail regardless of what your policy says.
Questions
SPF passes. Why is this still failing?
Almost certainly alignment. DMARC requires the domain that passed to match the one in the visible From:, and a pass for your ESP's bounce domain does not. Check the Authentication-Results header on a delivered copy to see which domain actually passed.
Should I set p=none to make it stop?
It will stop this specific reply and leave you unauthenticated, which Google now refuses from bulk senders on its own terms. Fix the authentication rather than withdrawing the policy.
Why does it only happen on forwarded mail?
Forwarding breaks SPF — the forwarder's server is not in your record — and a list that modifies the message breaks DKIM too. ARC exists to carry the original result across the hop; without it there is nothing left to pass.