When sending an email to a Gmail address, you may receive a bounce-back error stating that DKIM and SPF authentication checks did not pass. Gmail rejects unauthenticated emails to protect its users from spam and phishing.
Symptoms
You receive a bounce-back message similar to this:
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
[email protected]
host gmail-smtp-in.l.google.com [xxx.xxx.xxx.xxx]
SMTP error from remote mail server after end of data:
550-5.7.26 This mail is unauthenticated, which poses a security risk to the
550-5.7.26 sender and Gmail users, and has been blocked. The sender must
550-5.7.26 authenticate with at least one of SPF or DKIM. For this message,
550-5.7.26 DKIM checks did not pass and SPF check for [yourdomain.com] did not
550-5.7.26 pass with ip: [xxx.xxx.xxx.xxx].
550 5.7.26 instructions on setting up authentication.
Key indicators in this error:
- 550 5.7.26 — Gmail's rejection code for unauthenticated email
- DKIM checks did not pass — Your domain's DKIM record is missing or incorrect
- SPF check did not pass — Your domain's SPF record is missing or incorrect
Causes
This error occurs when your domain's DNS is missing the email authentication records that Gmail requires:
- SPF (Sender Policy Framework) — A DNS TXT record that specifies which mail servers are allowed to send email on behalf of your domain
- DKIM (DomainKeys Identified Mail) — A DNS TXT record containing a public key that verifies your emails are genuinely from your domain and haven't been tampered with
Solution: Repair via cPanel (Recommended)
If your domain uses Cynet nameservers (ns1.cynethost.com through ns4.cynethost.com), cPanel can fix this automatically.
Step 1: Log in to cPanel
Navigate to yourdomain.com/cpanel or log in via the Cynet client area.
Step 2: Open Email Deliverability
In the cPanel dashboard, scroll to the Email section and click Email Deliverability.
Step 3: Check Your Domain Status
You'll see a list of domains on your account. Look for a status like:
- ⚠️ Problems Exist — One or more authentication records are invalid or missing
- ✅ Valid — All records are correctly configured
Step 4: Click Repair
Click the Repair button next to the affected domain. cPanel will automatically:
- Generate and install the correct SPF TXT record
- Generate and install the correct DKIM TXT record
- Verify the records are resolving properly
Step 5: Test Again
Send a test email to the Gmail address that previously bounced. The email should now be delivered successfully.
Note: DNS changes may take up to 1–2 hours to fully propagate, though most take effect within minutes on Cynet nameservers.
Solution: Manual DNS Update (External DNS)
If the Repair button is disabled or greyed out, it means your domain's DNS is not hosted on cPanel — you're using external nameservers (e.g., Cloudflare, GoDaddy DNS, Namecheap DNS). In this case, you need to manually add the records at your DNS provider.
Step 1: Get the Required Records
- In cPanel → Email Deliverability, click Manage next to the affected domain
- You'll see the exact SPF and DKIM records your server requires
- Copy these records — you'll need them for the next step
Step 2: Add SPF Record
At your DNS provider, add a TXT record:
| Host | Type | Value |
|---|---|---|
| @ | TXT | v=spf1 +a +mx +ip4:YOURSERVERIP ~all |
Replace YOURSERVERIP with the actual value shown in cPanel's Email Deliverability → Manage.Step 3: Add DKIM Record
At your DNS provider, add a TXT record:
| Host | Type | Value |
|---|---|---|
| default._domainkey | TXT | (the full DKIM key from cPanel) |
The DKIM value is a long string. Copy-paste it exactly from cPanel — do not modify it.
Step 4: Wait for DNS Propagation
External DNS changes can take 1–24 hours to propagate. After propagation, test by sending an email to Gmail again.
Verifying Your Email Authentication
After applying the fix, verify everything is working:
Method 1: Send to Gmail
- Send an email to a Gmail address
- Open the email in Gmail
- Click the three dots (⋮) → Show original
- Look for:
Method 2: Use an Online Tool
Send a test email to mail-tester.com — it provides a score out of 10 and flags any authentication issues.
Prevention
To avoid this issue in the future:
- Don't modify SPF/DKIM records unless you know what you're doing — incorrect records break email authentication
- Check deliverability after DNS changes — Whenever you change nameservers or DNS, verify Email Deliverability in cPanel afterwards
- Set up DMARC — Add a DMARC record for an additional layer of email authentication. A basic DMARC record:
v=DMARC1; p=none; rua=mailto:[email protected] - Monitor bounce-backs — If you start seeing delivery failures, check Email Deliverability in cPanel immediately