What the message looks like
550-5.7.26 This mail has been blocked because the sender is unauthenticated550-5.7.26 Unauthenticated email from example.com is not accepted due to domain's DMARC policy550 5.7.26 Multiple authentication checks failed5.7.1 Rejected due to DMARC failure
What it means
The email failed the receiving server's authentication checks. Either it passed neither SPF nor DKIM, or it failed DMARC for a domain whose DMARC policy says to reject such mail. The standard name for this status is "multiple authentication checks failed".
You'll see this most often from Gmail, which requires every sender to pass SPF or DKIM, and bulk senders to pass DMARC. Gmail also uses a few related codes for bulk senders: 5.7.27 when SPF fails, 5.7.30 when DKIM fails, 5.7.32 when the From address doesn't line up with SPF or DKIM, and 5.7.40 when the domain has no DMARC record. Each has a temporary 4.7.x version that Gmail sends first.
Common causes
- The sending domain has no SPF or DKIM set up for the service that sent the email.
- The email was sent through a service that signs it with its own domain, so it doesn't line up with the From address and fails DMARC.
- Someone is spoofing the domain, and DMARC is doing its job.
- A forwarding service passed the email on without keeping it authenticated.
If you're the recipient
If it's someone you know, let them know their emails are being rejected and pass on the error. If the email claimed to be from a bank or other big company, it may have been a spoofing attempt that was correctly blocked.
If you're the sender
Set up SPF and DKIM for every service that sends as your domain, and make sure DKIM signs with your own domain so it lines up with the From address. Then publish a DMARC record. Start with p=none and check the reports before moving to quarantine or reject.
If you use addy.io
addy.io sends forwarded emails from its own domain with its own SPF and DKIM, so they pass these checks at your inbox provider. It also checks the original sender's DMARC result and follows the sender's own policy:
p=reject- the email is rejected with5.7.1 Rejected due to DMARC failure.p=quarantine- the email is quarantined instead of forwarded, and appears on your Failed Deliveries page.p=none, or a softer failure - the email is forwarded with a warning banner. Paste the email's headers into the email header analyser to see why it failed.
If you reply or send from an alias, your recipient's domain must pass DMARC. See I'm trying to reply/send from an alias but it is rejected.