What it looks like in your logs
550-5.7.27 Your email has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with SPF. SPF check for example.com did not pass with ip: [203.0.113.10]. - gsmtpWhat does 5.7.27 mean?
RFC 7505 registered X.7.27 as "sender address has null MX". If the domain in your envelope sender publishes a null MX, it has declared that it cannot receive mail, which means it cannot receive bounces or replies either. Receivers that check this refuse the message. It is usually a DNS mistake on a domain that was set up for a website only.
Gmail uses 5.7.27 for a different and far more common problem: the sender did not meet its SPF authentication requirement. Since the February 2024 sender rules, Gmail expects mail to pass SPF for the sending domain, and the rejection text names the domain and IP that failed. If your bounce comes from Gmail and mentions SPF, treat 5.7.27 as an SPF fix.
Either way the cause is on your side, in the DNS of the domain you send from. Check the SPF record for the return-path domain, and check that the domain has real MX records rather than a null MX.
Soft or hard bounce?
| Soft bounce (4xx) | Hard bounce (5xx) | |
|---|---|---|
| Nature | Temporary | Permanent |
| Sender behaviour | Queue and retry with backoff | Stop, suppress the address |
| Reputation risk | Low, unless it repeats for days | High above a 2% bounce rate |
| 5.7.27 | ✓ this code |
Common causes
- The sending IP is not authorized in the SPF record of the envelope sender domain.
- The return-path domain has no SPF record at all.
- The SPF record exceeds 10 lookups or has a syntax error, so it does not pass.
- The sender domain publishes a null MX record (0 .) and cannot receive bounces.
- A domain created for a website was reused for sending without adding mail DNS.
How to fix 5.7.27
- Check the SPF record for your return-path domain with the SPF checker and add the IP or include for the service that sent the message.
- If the record is broken or too long, rebuild it with the SPF generator and keep it under 10 lookups.
- Look up the sender domain with the MX lookup; if it shows a null MX, replace it with real MX records.
- Add DKIM signing so the domain still authenticates when SPF breaks; the email authentication guide explains how the two work together.
- Send a test to a Gmail address and confirm SPF shows as pass in the message headers before resuming volume.
5.7.27 questions
What does 550 5.7.27 mean from Gmail?
It means Gmail rejected the message because the sender did not pass SPF authentication. The bounce text usually names the domain and IP that failed. Add that sending IP or service to the SPF record of your envelope sender domain.
What does sender address has null MX mean?
It is the official meaning of 5.7.27. Your sending domain publishes an MX record pointing to a single dot, which says it accepts no mail. Receivers reject mail from such domains because bounces cannot be returned. The recipient-side equivalent is 5.1.10.
Should my sending domain have a null MX?
No. Any domain you send from should be able to receive bounces and replies, so it needs working MX records. Publish a null MX only on domains that never send or receive mail, together with an SPF record of v=spf1 -all. Our guide to DNS records for email shows both setups.