Every error, explained and fixed.
Each guide states the cause in one paragraph, then the exact steps to resolve it, with a link to the free tool that verifies the fix.
550 5.7.26 authentication required (Gmail)
Gmail returns 550 5.7.26 when a message fails sender authentication before inbox placement. The envelope-from domain must pass SPF or DKIM with DMARC alignment on the visible From domain. Fix authentication on your sending path: M365, Google Workspace, or ESP relay. Then re-test.
SPF PermError: Permanent error
SPF PermError means receivers cannot evaluate your SPF record. The usual causes are more than 10 DNS lookups (nested includes), invalid syntax, or multiple SPF TXT records on one domain. Receivers treat permerror as a hard evaluation failure, which breaks DMARC on the SPF leg.
DMARC alignment failed: SPF passed
When SPF passes but DMARC fails, the authenticated domain (envelope-from for SPF or d= for DKIM) does not align with the header From domain under your DMARC policy (strict or relaxed). Receivers treat the message as unauthenticated for DMARC purposes.
Gmail unverified sender warning
Gmail shows unverified sender when it cannot verify your domain on the message. Usually missing DMARC, unsigned DKIM, or SPF/DKIM that does not align with the From: address. Marketing and transactional mail from ESPs triggers this most often when only SPF exists on the root domain.
SPF too many DNS lookups
RFC 7208 limits SPF evaluation to 10 DNS lookups. Exceeding that triggers PermError. Receivers cannot validate SPF. Each include:, a, mx, ptr, and exists mechanism in the evaluation chain counts, including nested includes inside delegated records.