TL;DR
Permanent rejection: more than one required authentication check failed under local policy. Identify which mechanisms failed and fix them before retrying. Multiple auth failures signal serious deliverability and reputation risk. Do not retry unchanged.
What this code means
More than one distinct authentication check treated as mandatory by the receiver's local policy failed for the message; registry pattern X.7.26 surfaces that combined result as code 5.7.26 in class 5. The leading digit marks a permanent outcome in the enhanced status register. The subcode reports a multi-check auth failure, not a single SPF, DKIM, or DMARC verdict. It does not by itself identify which mechanisms failed, whether the fault is signing, DNS, or policy configuration, or which party must remediate.
Provider examples
550 5.7.26 This email has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM. Authentication results: DKIM = did not pass SPF [domain-name] with ip: [ip-address] = did not pass. For instructions on setting up authentication, go to Email sender guidelines. - gsmtp550 5.7.26 The (E)MAIL FROM domain [domain-name] has an SPF record with a hard fail policy (-all) but it fails to pass SPF checks with the ip: [ip-address]. To best protect our users from spam and phishing, the message has been blocked. For more information, go to Email sender guidelines. - gsmtp550 5.7.26 Unauthenticated email from domain-name is not accepted due to domain's DMARC policy. Contact the administrator of domain-name domain if this was legitimate email. To learn about the DMARC initiative, go to Control unauthenticated email from your domain. - gsmtp<zopotodaniel@fyguare.com>: host aspmx.l.google.com[124.205.72.62] said: 550-5.7.26 Unauthenticated email from acme.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of acme.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. v10-20020a170906488a11b0098d8390816asi945962ejq.756 - gsmtp (in reply to end of DATA command)Technical meaning
A message that failed more than one authentication check, contrary to local policy requirements, matches X.7.26. The code does not specify which mechanisms failed. Code 5.7.26 assigns the result to the permanent-failure class through its leading digit.
Delivery status
The leading digit 5 denotes a permanent failure of the current attempt. The code confirms that multiple checks failed, but it does not identify their mechanisms, the precise cause, or the party responsible for the problem.
- Class
- Permanent failure
- Retry
- Do not retry unchanged
- Suppression
- Check the full context
Retry decision
Operational guidance: stop automatic and manual retries of the same unchanged attempt. Consider a new, controlled attempt only after identifying the failed checks, making a confirmed correction, and checking suppression again.
Suppression decision
Operational guidance: do not automatically suppress the recipient address or domain based on 5.7.26 alone. Inspect the complete response, event scope, authentication results, and delivery history, then base the suppression decision on the confirmed cause and applicable policy.
Common causes
- More than one message authentication check failed, contrary to local policy requirements.
Diagnostic steps
- Inspect the raw SMTP response or nondelivery report and confirm the exact 5.7.26 code and a basic reply in the 5xx class; retain the complete response text.
- Correlate the response with the intended message, attempt time and stage, identities used, and system that returned the code.
- Use available authentication results, logs, and configuration to establish which checks failed and which local-policy requirement was not met; do not derive those details from the code alone.
- Stop unchanged retries. After a confirmed correction, check authentication results and suppression again, then make at most one controlled attempt.
Actions by owner
Sender
- Do not manually retry the same unchanged message; confirm that the message and identities used are intended, then give the sender administrator the complete response and attempt time.
Sender administrator
- Retain the complete response, correlate it with the message and identities used, and inspect available authentication results, logs, and configuration to establish which checks failed.
- Make only a confirmed correction, check authentication results and suppression again, and verify the outcome with one controlled attempt.
Recipient administrator
- If you manage the system that returned the code, inspect its authentication-check logs and local policy for the specified attempt; correct a confirmed receiving-side problem or safely give the sender the details needed for remediation.
Provider
- If you operate a managed layer involved in the authentication checks, inspect its logs and configuration, correct a confirmed problem in that layer or give the appropriate administrators precise diagnostic context, and do not trigger suppression from the code alone.
Sources
These sources define what this enhanced status code means, mainly through the IANA registry and related RFCs. When provider examples appear on the page, they come from that provider's published documentation. Follow the links to read the original wording in context.
- SMTP Enhanced Status Codes — IANA registry of enhanced mail system status codes.
- RFC 5248 — A Registry for SMTP Enhanced Mail System Status Codes — Creates and governs the IANA enhanced status code registry.
- RFC 2034 — SMTP Service Extension for Returning Enhanced Error Codes — Defines how SMTP returns enhanced status codes to clients.
- RFC 7372 — Email Authentication Status Codes — Status codes for SPF, DKIM, DMARC and related authentication results.
- Gmail SMTP errors and codes — Official Gmail Help table of SMTP error messages and status codes.
- email-bounce-parser (test fixture corpus) — Open-source bounce-parsing library whose test fixtures are pinned locally as evidence.
Last verified:
