When an email fails authentication, the receiving server returns a numeric SMTP code plus a short description. Gmail and Yahoo mainly use the 5xx series, which tells you the message will not be retried. For example, Gmail may return “550 5.7.26 Unauthenticated email” while Yahoo might send “553 5.7.1 Connections will not be accepted because the IP is on a blacklist.”
Google blocks messages that don’t pass DMARC, SPF, or DKIM checks. The 550 5.7.26 code specifically indicates the sender’s domain has a DMARC policy that rejects unauthenticated mail. Fix this by ensuring your SPF record includes the sending IP, signing outgoing mail with DKIM, and publishing a DMARC record that aligns both.
This code signals the sending IP is not authorized to connect directly to Google’s servers – often because the IP is on a blacklist. Removing the IP from blacklists and confirming it’s listed in your SPF record resolves the issue.
Yahoo uses 553 and 554 codes for authentication failures and reputation problems. A typical message reads “553 5.7.1 Connections will not be accepted from x.x.x.x because the IP is on Spamhaus’s list.” The fix involves cleaning the IP reputation, updating SPF, and ensuring DKIM signatures are valid.
4xx codes are temporary failures – the server suggests you try again later (e.g., “421 Server busy”). 5xx codes are permanent failures – the server will never accept the message unless you change something (e.g., “550 User not found”). Gmail and Yahoo’s new policies mainly generate 5xx codes for non‑compliant mail.
Use Palisade’s SPF lookup tool to verify the record syntax and ensure the sending IP is included. The tool will highlight hard‑fail (-all) policies that may cause rejections.
1. Publish a DMARC record at _dmarc.yourdomain.com
.
2. Start with p=none
and add an RUA address to collect reports.
3. Align SPF and DKIM to the same domain (or sub‑domain) used in the From address.
4. Gradually raise the policy to p=quarantine
then p=reject
after you’ve resolved reported issues.
5. Use Palisade’s DMARC record generator and DMARC lookup tool to validate the setup.
Generate a DKIM key pair for your domain, publish the public key in a DNS TXT record, and configure your mail server to sign outgoing messages with the private key. Palisade’s DKIM tool can help you generate and test the selector.
BIMI (Brand Indicators for Message Identification) lets you display your logo next to authenticated messages in supporting inboxes. While not required for delivery, it boosts brand trust. Set up a verified logo and add a BIMI DNS record using Palisade’s BIMI tool.
Google publishes its full list here. Yahoo’s guide is available here. Refer to those pages for specific wording and additional troubleshooting tips.
First, run a DMARC, SPF, and DKIM check with Palisade’s tools. Next, review the reports to pinpoint the failing source (IP, sub‑domain, or third‑party service). Finally, correct the DNS records, re‑authenticate the sending service, and monitor the reports until the error disappears.
p=none
to collect data, then move to p=quarantine
and finally p=reject
once you’re confident all legitimate mail passes.include:spf.sendgrid.net
) to your SPF record.Need hands‑on help? Palisade offers a guided setup to get SPF, DKIM, DMARC, and BIMI right the first time. Start your compliance journey today.