SMTP 550 5.7.26 / 5.7.23: Gmail DMARC & SPF fails

Gmail (and Microsoft with 5.7.509/5.7.515) rejects the message because it is not authenticated via SPF or DKIM in alignment with the From domain.

Common causes

• The sending IP (newsletter tool, CRM, web shop) is missing from the SPF record.
• SPF exceeds the 10 DNS lookup limit and returns permerror.
• DKIM is not signing, or the DNS selector does not match the key.
• No alignment: SPF/DKIM pass for a different domain than the one in From:.
• Forwarding through third-party servers breaks SPF and there is no DKIM to fall back on.

How to check it

Query the sender domain's SPF record

dig +short TXT example.com | grep spf1

Query the DMARC policy

dig +short TXT _dmarc.example.com

Check the DKIM key for the selector

dig +short TXT default._domainkey.example.com

What actually helps

1. Add every sending source via ip4:/include: to SPF and end it with ~all or -all.
2. Keep SPF under 10 lookups: drop unused includes or replace them with IP ranges.
3. Enable DKIM signing on the mail server or sending service and publish the public key at selector._domainkey.

FAQ

What is the difference between 5.7.26 and 5.7.23?

5.7.26 means DMARC failed or the mail is not authenticated at all. 5.7.23 means the SPF check itself hard-failed, typically with -all.

Is SPF alone enough for Gmail?

Not for bulk senders – Google requires SPF and DKIM plus DMARC. Even at low volume DKIM is the more robust base because it survives forwarding.

Full page with every command and the German/Italian version: daniele-michelin.com/en/errors/smtp-550-5-7-26/

First published at daniele-michelin.com. The error lexicon covers HTTP, DNS, TLS, mail, database, PHP, nginx, systemd and Nextcloud, in German, English and Italian.