Critical ErrorSMTP Error · Permanent (5.x.x)
550 5.7.27

Gmail blocked the message: SPF did not pass

A 550 5.7.27 from Gmail means the message was rejected because SPF failed. Gmail says: "This message was blocked because it didn't pass SPF authentication." The temporary form is 421 4.7.27.

Updated June 13, 2026

SMTP Exchange / Mail Log
> MAIL FROM:<you@yourdomain.com>> RCPT TO:<recipient@example.com>✕ 550 5.7.27 Gmail blocked the message: SPF did not pass
All guides

Is your domain affected?

Run a free check — we'll show you exactly what's misconfigured.

550 5.7.27 is a permanent SMTP reply meaning gmail blocked the message: spf did not pass. The IP that delivered the message is not allowed by the SPF record of the envelope sender (Return-Path) domain. Gmail now enforces this for bulk senders.

What 550 5.7.27 means

The IP that delivered the message is not allowed by the SPF record of the envelope sender (Return-Path) domain. Gmail now enforces this for bulk senders.

⚠️
This is a 5.x.x permanent failure — the message will keep bouncing until you fix the cause. Retrying the same message unchanged won't help.

Common causes

📨
#1

The sending IP or service is not listed in SPF

Most common

You moved to a new ESP, added a server, or changed providers, and SPF was not updated.

🔁
#2

SPF has more than 10 DNS lookups

Common

Too many include: entries make SPF return permerror, which counts as a fail.

⚙️
#3

There are two SPF records

Common

Two TXT records that start with v=spf1 make SPF invalid. Merge them into one.

How to fix 550 5.7.27

  1. 1

    Check which IP sent the message

    Read the bounce or the Received header to find the sending IP and the Return-Path domain.

  2. 2

    Fix the SPF record for that domain

    Add the provider's include: or the server IP to one SPF record. If you are over 10 lookups, remove unused includes or flatten the record.

  3. 3

    Verify before you resend

    Run the free SPF checker to confirm the record is valid, has one copy only, and stays under the lookup limit.

Confirm your domain is set up correctly

Most delivery failures — permanent or temporary — trace back to authentication or reputation. Run a free EmailHealth check to confirm SPF, DKIM, DMARC, blacklist status, and TLS are all healthy for your sending domain. If you send in volume, free daily monitoring will alert you before a small issue becomes a flood of bounces.

Stop this error from coming back

Most delivery problems start when a DNS record changes, a key is removed or a domain lands on a blocklist. EmailHealth checks your sending domains every day and sends one alert, by email, Slack or webhook, with the exact fix.

1 domain free. Sending from many domains (cold email, agencies, MSPs)? Early access covers 10.

Frequently asked questions

Check your domain for free

SPF, DKIM, DMARC, MX, blocklists and TLS in about 2 seconds. No account needed.

Run the check