How does ZeroHook verify my domain security?

ZeroHook performs a tiered security audit: 6 checklist checks on Free and 35 on paid tiers, covering DMARC, SPF, DKIM, DNSSEC, MX records, SSL/TLS certificates, CAA records, BIMI, email routing, and DNS configuration.

How long does a scan take?

Most scans complete in under 60 seconds with real-time progress updates.

What is NIS2 compliance?

NIS2 is the EU's Network and Information Security Directive. Our reports help identify DNS security gaps and provide audit-ready documentation.

Back to blog

Infrastructure

Fix Gmail 550 5.7.26 Auth Errors

Gmail rejects 550 5.7.26 when SPF, DKIM, or DMARC alignment fails. Read the bounce and fix DNS fast.

ZeroHook Team

Security Analysts

Jun 21, 2026~4 min read

Your campaign hits a wall at Gmail. Not spam folder. Hard bounce. 550 5.7.26 Unauthenticated email from yourdomain.com is not accepted due to domain's DMARC policy Or the shorter variant: 550 5.7.26 This message does not meet the required authentication level A 9-person ecommerce team in Dublin saw this on 23% of order confirmations the day after they switched ESPs. Mailchimp showed green checkmarks in the UI. Gmail disagreed at the SMTP layer. The 550 5.7.26 authentication required error is Gmail's way of saying your message failed the minimum auth bar: SPF, DKIM, and DMARC alignment on the visible From: domain. Google tightened enforcement for bulk senders in February 2024 and kept tightening through 2025-2026 on relay and transactional paths that look like bulk mail. This is not a reputation soft fail. The message never gets filtered. It gets rejected.

What Gmail 550 5.7.26 Actually Means

SMTP code 550 is a permanent failure (don't retry). Enhanced status 5.7.26 is Gmail-specific: authentication required.

What Gmail checked

Google evaluates three legs on inbound mail:

SPF: did the sending IP match your SPF record?
DKIM: did the message carry a valid signature for your domain?
DMARC: did at least one of SPF or DKIM align with the From: header domain?

You need DMARC alignment pass, not just SPF pass or DKIM pass alone. That distinction is why teams stare at "authenticated" in their ESP dashboard and still get 550 5.7.26 from Gmail.

Warning

If your DMARC policy is p=reject and alignment fails, Gmail may cite "domain's DMARC policy" in the bounce text even when the underlying problem is a missing DKIM signature, not the policy itself.

The Three Causes We See Most Often

1. ESP relay with wrong envelope-from

Mailchimp, Klaviyo, SendGrid, and HubSpot often send with their own bounce domain unless you configure custom domain authentication. SPF passes for mailchimp.com. Your From: says [email protected]. DMARC alignment fails. Gmail returns 550 5.7.26.

2. DKIM not published or not enabled

We've had teams enable DKIM in Microsoft 365 admin but skip the CNAME step in Cloudflare. The toggle is on. The signature is missing. Gmail rejects.

3. DMARC record missing entirely

No _dmarc.yourdomain.com TXT record means receivers apply default policy. Combined with misaligned ESP mail, that is an easy 550.

Pro tip

Paste the full bounce into a text file and search for "550 5.7.26" and "dmarc=". The surrounding text usually names which leg failed.

How to Fix 550 5.7.26 (Step by Step)

Send a test email to a Gmail address you control. Open the message (if it arrives) or read the bounce body. In Gmail, open a received copy → Show original → look for Authentication-Results. Note spf=, dkim=, and dmarc= for your domain.

Fix SPF at the root domain. Microsoft 365 example in Cloudflare DNS:

v=spf1 include:spf.protection.outlook.com -all

Google Workspace:

v=spf1 include:_spf.google.com -all

For ESP relay, add the provider include (e.g. include:servers.mcsv.net for Mailchimp) and keep total DNS lookups under 10.

Enable and publish DKIM. M365: Admin center → Settings → Domains → your domain → DKIM → create CNAME records for selector1 and selector2, wait for DNS propagation, then enable signing. Google Workspace: Admin → Apps → Google Workspace → Gmail → Authenticate email → Generate record → publish TXT at google._domainkey.

Publish DMARC at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r

Start with relaxed alignment (adkim=r; aspf=r) while debugging. Move to quarantine/reject after 2-4 weeks of clean aggregate reports.

In your ESP, turn on "domain authentication" or "custom return path" so the envelope-from matches your domain, not the ESP default. Without this, SPF alignment for DMARC often still fails.

Re-send the test. Authentication-Results should show dmarc=pass. Retry the campaign only after a clean test; Gmail remembers recent auth failures on the same domain/IP pair.

Frequently Asked Questions

Key takeaways

550 5.7.26 means Gmail rejected mail for failed authentication alignment, not spam scoring.

ESP "verified domain" UI can show green while envelope-from still breaks DMARC alignment.

Fix order: DKIM publish → SPF include → DMARC record → ESP custom return path → test Authentication-Results.

Use relaxed DMARC alignment (adkim=r, aspf=r) while debugging, then tighten policy after reports look clean.

Map SPF, DKIM, and DMARC in one view at zerohook.org/dns-visualizer before you edit records, so the next test send does not hit another 550 5.7.26 wall.

Share this analysis

Help others discover this content

Fix DNS before the next audit

Provider-specific copy-paste fixes for Cloudflare, Route53, GoDaddy, and more.

Start free scan