In brief
- Typical text: "Gmail requires all senders to authenticate with either SPF or DKIM."
- Since February 1, 2024, Gmail requires SPF or DKIM from all senders. Above 5,000 messages per day to Gmail, SPF, DKIM and DMARC are all required.
- Three documented causes: SPF or DKIM missing or failing, SPF with "-all" that excludes your IP, DMARC policy not satisfied.
- The fix is made in the DNS zone of your domain, then checked with dig and in the header of the received message.
What Gmail checks
Gmail checks whether the message passes SPF (the sending IP is authorized by the domain) or DKIM (the message signature is valid). For large senders, it also asks that the domain of the From address match the domain authenticated by SPF or by DKIM: this is called alignment, and it is what DMARC verifies.
A DKIM key must be at least 1,024 bits, and Google recommends 2,048 bits. SPF can pass while DMARC fails when SPF authenticates a technical sending domain, for example the one of your campaign tool, instead of your address domain.
The causes, and how to tell them apart
Neither SPF nor DKIM valid for the sending domain
How to recognize it: The refusal cites the SPF or DKIM authentication requirement. The dig command on the domain shows no v=spf1 line and no DKIM key.
What to do:
- Publish an SPF record that includes your mailbox provider. The exact values for Google Workspace and Microsoft 365 are in the provider pages linked at the bottom of the page.
- Enable DKIM signing at your provider and publish the key it gives you. Some providers do it automatically; check it with dig.
- Wait for propagation: the delay announced by each provider ranges from a few minutes to 48 hours depending on the record.
Hard SPF failure: your IP is not in the list
How to recognize it: The refusal says that SPF failed and that the domain has a strict policy (-all). This is the typical case of a sending tool added without being added to the SPF.
What to do:
- Find the IP address in the Received header of the original message, then look up which service it belongs to.
- Add the include of that service to the existing SPF record, before the "all". A domain must have only one v=spf1 record: creating a second one invalidates both.
- Watch the SPF limit of ten DNS lookups if you combine several services.
DMARC policy not satisfied
How to recognize it: The refusal mentions the DMARC policy of the domain. It is set to quarantine or reject, and neither SPF nor DKIM is both valid and aligned with the domain of the From address.
What to do:
- Have the message signed with DKIM using the domain of the From address (not the sending tool's domain): this is the most reliable way to get alignment.
- If you have not read any DMARC reports yet, set the policy back to p=none while you observe, then tighten it in stages.
- Messages forwarded by a third party often break SPF: only an aligned DKIM survives forwarding.
Check your DNS
Three commands to see what Gmail sees, then a look at the header of the received message to confirm the actual result.
Read the SPF record of the sending domain
dig +short TXT yourdomain.com
Expected result: A single line starting with v=spf1. No line: no SPF. Two v=spf1 lines: the SPF is invalid and always fails.
Read the DKIM key (replace the selector with the one your provider uses)
dig +short TXT selector._domainkey.yourdomain.com
Expected result: A public key (p=...). Some providers publish a CNAME instead of a TXT record: in that case dig shows the CNAME target, then the key.
Read the DMARC record
dig +short TXT _dmarc.yourdomain.com
Expected result: A line starting with v=DMARC1 and containing a policy p=none, quarantine or reject.
Confirm in Gmail with a test message
Gmail: open the message, ⋮ menu, "Show original"
Expected result: The header shows SPF, DKIM and DMARC with PASS or FAIL. Send the test from the exact mailbox and tool that received the refusal.
Check your whole domain at once
The free diagnostic reads your SPF and your DMARC and looks for a DKIM signature, with no account. It is the fastest way to find out whether authentication is the problem.
Test my domain nowWhat not to do
- Going straight to DMARC p=reject without having read any reports: you risk blocking your own legitimate sending.
- Adding a second SPF record for a new tool instead of editing the first one.
- Copying an SPF value found on a forum. Each provider publishes its own; at o2switch, for example, a different value can prevent sending.
Frequently asked questions
What does 5.7.26 mean at Gmail?
Gmail rejected the message because it does not pass the required authentication: SPF or DKIM for all senders, and DMARC as well above 5,000 messages per day to Gmail.
Do I need DMARC if I send few messages?
For sending below 5,000 messages per day to Gmail, SPF or DKIM is enough to avoid the 5.7.26. DMARC is required above that, but the policy can stay at "none". Enabling it early avoids a bad surprise the day your volume grows.
SPF and DKIM are correct, so why does DMARC still fail?
Because DMARC also requires alignment: the authenticated domain must match the domain of the From address. A valid SPF for the technical domain of a sending tool is not enough.
How long should I wait after fixing the DNS?
Each provider announces its own delay: for example up to 24 hours at OVHcloud and up to 48 hours for IONOS SPF. Check with dig that the record is visible before resending.
Official sources
Messages and fixes taken from the official documentation on October 21, 2026. Providers sometimes change their wording: if there is a discrepancy, the official page prevails.
Read next
Set up authentication at your mailbox provider
Other errors
Prospect without damaging your domain
Fluenzr sends from your own mailbox, warms up its sending history and monitors its reputation.
Start my 14-day trial