Gmail returns 550 5.7.26 when it refuses a message for lack of authentication. The code is the same in all cases, but the text after it is not, and Google's list of SMTP codes has three different versions with three different fixes, so the line in your bounce decides which section below applies.
"This email has been blocked because the sender is unauthenticated"
Older bounces say "This mail has been blocked". Neither SPF nor DKIM passed, so Gmail has nothing that ties the message to any domain. The rest of the bounce usually lists both results, along the lines of DKIM = did not pass and SPF [example.com] with ip: [203.0.113.5] = did not pass, which tells you the domain and the server Gmail looked at.
The usual reasons:
- the server or service that sent the message is not in your SPF record;
- the service does not sign with DKIM at all, or signs with a key that is no longer published;
- the message went out from a script, a printer, a website form or a CRM straight to Gmail, bypassing the mail provider that is set up correctly.
Fix whichever applies: add the service to SPF, or better, set up DKIM for it under your domain. One of the two passing is enough to get past this version of the bounce.
"The (E)MAIL FROM domain has an SPF record with a hard fail policy (-all)"
Here SPF did not just fail, it failed against a record that ends in -all, which tells receivers to refuse mail from any server not listed. Gmail took you at your word. Either the sending server belongs in the record and is missing, or the mail is going out through a server it should not.
Put the server's include, or its address, into the record. If you are still finding out which services send as the domain, ~all softfails instead of refusing, and DMARC decides what happens.
"Unauthenticated email from example.com is not accepted due to domain's DMARC policy"
This one is about DMARC. Your domain publishes p=reject, and the message passed neither SPF nor DKIM for the domain in the From line. Often both did pass, but for a sending service's own domain, so nothing aligned. The page on DMARC fail shows how to read that in the headers.
Two things work: make the service sign DKIM with your domain, or give it a return path on your domain so SPF aligns. Lowering the policy to p=none makes the bounce go away and stops protecting the domain at the same time, which is why it only buys time while one of the two fixes goes in.
The temporary version
421 4.7.26 with "This email has been rate limited because it is unauthenticated" is the same complaint as a deferral, with Gmail slowing the mail down instead of refusing it outright. The fixes are the ones for the first version above.
Checking the fix
The SPF, DKIM and DMARC lookups confirm the records are in place, but Gmail judges the message, so records alone do not settle it. After the change, send one through the full test from the same service that bounced.
The report names the envelope domain SPF was checked for, the d= domain of every DKIM signature and the From domain DMARC was applied to. Those three names tell you which of the versions above you would still get.