Email delivery
Fix Gmail 550 5.7.26: A Practical SPF and DKIM Checklist
How to diagnose Gmail rejection for an unauthenticated sender by checking SPF, DKIM, the sending IP, and the From domain.
Read the authentication result in the bounce
The 550 5.7.26 response shows the SPF domain, sending IP, and whether DKIM passed. If both SPF and DKIM fail, the recipient address is not the root cause; sender authentication is. Confirm that the reported domain also aligns with the visible From address.
SPF must include the actual sending server
Publish one SPF TXT policy at the root domain. It must authorize the include value or sending IP supplied by OfficialMail. Multiple SPF records or a record placed on the wrong host can produce permerror or fail.
Use the DKIM key issued for the current domain
A DKIM public key is resolved by selector and domain. Copying a key from another company or a previous server makes the message signature and DNS key disagree. After regeneration, replace the old DNS value and wait for propagation before testing again.
Retest with a new message
Messages already queued can still carry an older signature even after DNS looks correct. Compose a new message and confirm spf=pass, dkim=pass, and preferably dmarc=pass in Gmail's original message view. If the bounce reports an unexpected IP, inspect the outbound route as well.
Start with OfficialMail
Start operating with one official primary mailbox.
Use one primary mailbox as your company's official address and review every domain-connection value directly in the mailbox.