How to check SPF, DKIM and DMARC for Gmail
Test authentication on actual messages and identify alignment problems across sending platforms.
Publishing DNS records is only part of authentication. You also need to know whether each platform uses them correctly on the messages it sends.
A successful test from your employee mailbox does not verify the newsletter, CRM and billing platform.
Build a sender inventory
For every system, record its purpose, visible From domain, Return-Path domain and DKIM signing domain. Send a fresh example from the real workflow and inspect Gmail's Show original view.
SPF checks whether the sending server is authorised for the envelope domain. DKIM verifies the signature against the signing domain. DMARC requires a passing SPF or DKIM result that aligns with the visible From domain under the domain's alignment settings.
Bulk senders need both SPF and DKIM under Gmail's requirements. Only one must align to satisfy the stated alignment requirement, although Google recommends aligning both.
Compare the domains, not just the pass labels
Compare the visible From domain with the authenticated SPF domain and each valid DKIM signing domain. A passing signature for an unrelated provider domain does not, by itself, satisfy DMARC alignment. Inspect both the SPF and DKIM paths before concluding that DMARC fails.
Strict alignment requires an exact domain match. Relaxed alignment permits matching organizational domains. A DKIM selector identifies the signing key; it is not the identity used for DMARC alignment.
Fix the responsible sender
Use your ESP's custom authentication instructions for that specific account and sending domain. Check whether the expected DKIM records exist, whether the platform has enabled signing, and whether the configured return path is actually being used.
Do not assume adding an SPF include to the website domain repairs mail using a different envelope domain. Confirm the identity Gmail checked in the failing message.
Use reports to find gaps
Postmaster Tools helps reveal changes in authentication results. DMARC aggregate reports can help identify senders using your domain when reporting has been configured and receivers provide reports.
A p=none policy can meet Gmail's minimum bulk-sender policy requirement, but it is a monitoring policy. It does not request rejection of failing messages. Review legitimate senders before moving to quarantine or reject, and repair a broken legitimate route before weakening an established policy by default.
After any fix, inspect new messages from the affected workflow. Record the before-and-after domains and results so that the next person can verify what changed.
Related guides
Gmail SMTP error codes: what they mean and how to fix them
- Gmail deliverability: a practical starting point
- How to set up Google Postmaster Tools
- How to fix Needs work in Gmail compliance status
- How to investigate Gmail delivery errors
- Your domain architecture is part of your product infrastructure
- How to maintain SPF for Google Workspace