A Gmail bounce with 550 5.7.26 while your panel still shows a valid SPF record feels contradictory. The TXT is there. Dig returns it. Gmail still rejects the message. In most of these cases SPF is not “missing” — DMARC alignment fails, or the visible From domain does not match the identity that actually authenticated.
Since 2024 Gmail has hardened unauthenticated and bulk mail. The 5.7.26 text usually points at failed SPF/DKIM/DMARC or an unauthorized From. Your pattern: SPF exists, the sending IP is listed, yet the From domain and the domain SPF or DKIM authenticated are not organizationally aligned — or a relay rewrites From.
What 5.7.26 actually flags
The code does not always mean “no SPF record.” Common fragments mention authentication failed, unauthenticated email, or DMARC policy. Seeing v=spf1 mx ip4:45.84.90.12 -all in the panel only proves that policy is published for that zone. Gmail asks a sharper question: does the From: domain align with the envelope MAIL FROM that SPF checked, or with the DKIM d= domain?
SPF can pass while DMARC fails
Classic trap: a web form or billing tool sends with From support@yourcompany.com while the envelope belongs to the vendor’s domain. SPF passes on the vendor domain; DMARC evaluates From and fails alignment. Another trap: Reply-To is correct, From still points at an old hosting domain. On EuroVDC corporate email, MX should be securemail.eurovdc.eu (priority 10), and outbound mail must align SPF/DKIM with that same From zone.
Record table and alignment notes: SPF, DKIM, DMARC and deliverability. If nameservers are ns1.eurovdc.eu / ns2.eurovdc.eu, edit the zone in the EuroVDC panel; record types: nameservers and DNS records.
Diagnostic order
- Read Authentication-Results in the bounce: SPF=pass but DMARC=fail?
dig TXTon the apex and_dmarc— if policy is quarantine/reject, misaligned mail is cut on purpose.- Make the sending app’s From match the corporate domain; add third-party IPs to SPF or align that service’s DKIM to From.
- Merge duplicate SPF TXT records — two SPF strings violate the RFC and receivers may pick either.
Correct EuroVDC baseline
Typical corporate baseline: MX 10 → securemail.eurovdc.eu, SPF v=spf1 mx ip4:45.84.90.12 -all, DKIM often at dkim._domainkey. Those records belong in the From domain’s zone even if the website is hosted elsewhere. EU-hosted mailboxes: corporate email.
FAQ
Dig shows SPF — why 5.7.26?
Presence is not alignment. Gmail wants SPF or DKIM aligned to From. If the envelope is another domain, SPF can pass “elsewhere” while DMARC fails for From.
Is ~all enough?
For a dedicated corporate mailbox prefer -all. Softfail may limp through some paths but weakens DMARC; Gmail still rejects under strict checks.
Can SPF alone save me without DKIM?
DMARC needs one aligned pass. Forwards often break SPF; DKIM survives better. Publish both.
We still have p=none — why reject?
p=none is your domain policy. Gmail also applies its own rules and can return 5.7.26 on weak authentication.
How do I see which host sent the mail?
Open the raw headers of a test message: Received and Authentication-Results. If the sending IP is not 45.84.90.12 or your authorized path, fix SPF/DKIM for that source.
