If Gmail bounced your message with 550 5.7.26 This message does not have authentication information or fails to pass authentication checks, it is not a content problem. Gmail is telling you it could not verify who sent the mail. Here is how to find which check failed and fix it, in the order I would do it.
1. Read the bounce, then the headers
The bounce text names the failing mechanism. Look for "SPF", "DKIM" or "DMARC" in it. If you can get a delivered copy (send to a Gmail address you control that is not blocked), open "Show original" and read the Authentication-Results line:
spf=pass dkim=pass dmarc=pass
You need SPF or DKIM to pass, and for bulk senders both, and DMARC to pass with alignment. Anything else is what to fix.
2. SPF: one record, under 10 lookups
Check what you publish:
dig +short TXT yourdomain.com | grep spf1
Common faults:
-
Two SPF records. There must be exactly one
v=spf1TXT record. Merge them into one. -
More than 10 DNS lookups. Every
include:,a,mxandredirectcounts. Over 10 givespermerror, which Gmail treats as a fail. Remove providers you no longer use. -
Sending service missing. If your newsletter or invoicing tool sends as your domain, its
include:must be in the record. -
Ending in
+allor nothing. Use~allwhile you test and-allonce you are sure.
3. DKIM: sign with your own domain
Gmail wants DKIM signed with a domain that matches your From address. Enable DKIM in your mail provider and publish the CNAME or TXT record it gives you, then confirm the selector resolves:
dig +short TXT selector1._domainkey.yourdomain.com
A signature from the sender's own domain (for example a shared d=sendgrid.net) passes DKIM but will not align with your From domain, so DMARC still fails.
4. DMARC: publish it and make it align
Add a TXT record at _dmarc.yourdomain.com. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Read the aggregate reports for a couple of weeks, fix any legitimate sender that fails, then move to p=quarantine and later p=reject. Google's bulk-sender rules (more than 5,000 messages a day to Gmail) require DMARC, and it is the right baseline for everyone.
5. Test after DNS settles
DNS changes can take up to an hour to be seen everywhere. Send a test to a Gmail address and check Authentication-Results again. If dmarc=pass and the bounce is gone, you are done.
If you do not want to work through this by hand
I built a free checker that reads your domain's live SPF, DKIM and DMARC and lists what is wrong. A paid fix pack generates the exact records for your mail provider and DNS host. Both are on Email Fix Pack (disclosure: I made it). The error is covered in more detail on this page.
