Publishing DNS records is only part of authentication. You also need to know whether each platform uses them correctly on the messages it sends.

A successful test from your employee mailbox does not verify the newsletter, CRM and billing platform.

Build a sender inventory

For every system, record its purpose, visible From domain, Return-Path domain and DKIM signing domain. Send a fresh example from the real workflow and inspect Gmail's Show original view.

SPF checks whether the sending server is authorised for the envelope domain. DKIM verifies the signature against the signing domain. DMARC requires a passing SPF or DKIM result that aligns with the visible From domain under the domain's alignment settings.

Bulk senders need both SPF and DKIM under Gmail's requirements. Only one must align to satisfy the stated alignment requirement, although Google recommends aligning both.

Compare the domains, not just the pass labels

Suppose the From address is newsletter@example.com and DKIM passes for a provider-owned domain. That passing signature alone does not align with example.com. DMARC could still pass through aligned SPF, so inspect both paths before deciding it failed.

If DKIM signs with updates.example.com, it can align with example.com under relaxed alignment. Strict alignment requires an exact domain match. This distinction explains why an apparently similar setup can produce different results.

Fix the responsible sender

Use your ESP's custom authentication instructions for that specific account and sending domain. Check whether the expected DKIM records exist, whether the platform has enabled signing, and whether the configured return path is actually being used.

Do not assume adding an SPF include to the website domain repairs mail using a different envelope domain. Confirm the identity Gmail checked in the failing message.

Use reports to find gaps

Postmaster Tools helps reveal changes in authentication results. DMARC aggregate reports can help identify senders using your domain when reporting has been configured and receivers provide reports.

A p=none policy can meet Gmail's minimum bulk-sender policy requirement, but it is a monitoring policy. It does not request rejection of failing messages. Review legitimate senders before moving to quarantine or reject, and repair a broken legitimate route before weakening an established policy by default.

After any fix, inspect new messages from the affected workflow. Record the before-and-after domains and results so that the next person can verify what changed.

Sources