Sign in

SPF, DKIM, DMARC... All Set, And Gmail STILL Says Spam

Solveddkimdmarcemailspf14 replies · 456 views · started
Reply
Accepted solution by Nina — oh ive been there lol DMARC cares about alignment: the domain in the visible From addrses has to match teh DKIM d= domain or the SPF…
  1. Ada Torres
    @subnet_hound

    hmmmm ok I've followed three different guides and I'm more confused than before. Messages from the newsletter tool keep getting flagged by Gmail.

    Our DNS panel has a TXT record for SPF, another one someone added later, plus a DMARC record copied from a blog post. i suspect we made it worse. Can someone explain which records we actually need and how to tell if they pass? Please be gentle, email authentication is clearly not my strong side. what am i doing wrong??

    5
  2. Joon Celik
    @voxelprobe

    wait what does the Authentication-Results header say for SPF, DKIM and DMARC??

    6 1 helpful
  3. Kenji Wolfe
    @mutex_probe786

    hmmmm quick q which version are u on? ??

    2 0 helpful
  5. Wes Wolfe
    @vectorotter

    oh ive been there lol first, look at what the receiver actually saw... in Gmail use "Show original", in Outlook view message source... look for spf=pass, dkim=pass and dmarc=pass in the Authentication-Results header. anything that says fail or none tells u exactly which piece to fix.

    2 2 helpful
  6. Soren
    @soren_pixel

    been there man a domain must have only one SPF record. Two v=spf1 TXT records make SPF return a permanent error. merge them into one, for example v=spf1 include:_spf.provider-a.example include:provider-b.example ~all, and keep total DNS lookups at 10 or fewer. good luck man!

    1 0 helpful
  7. Priya Fischer
    @ping_pusher429

    lol same thing happened to me try turning off teh thermal paste first, fixed it for me fingers crossed 🤞

    1 0 helpful
  8. Theo E.
    @theo_cron
    in reply to @ping_pusher429

    contact forms that send mail From teh visiotrs addrses are sopofing that persons domain and will fail everywhere. send from ur own address (like noreply@yourdomain) and put the vsiitor's address in Reply-To.

    0 3 helpful
  9. Dev Fontaine
    @devf903

    for me it was the power plan. swapped it and boom, fixed

    18 0 helpful
  11. Rhea
    @daemonowl

    DKIM is per sending service. Every tool that sends as ur domain (mailbox provdier, newsletter tool, shop platform) needs its own DKIM key published, usually as a TXT or CNAME record at selector._domainkey.yourdomain... when you switch tools, the new one needs its own record. hope that helps :)

    15 0 helpful
  12. Nina
    @shadergarage
    Accepted solution

    oh ive been there lol DMARC cares about alignment: the domain in the visible From addrses has to match teh DKIM d= domain or the SPF envelope domain. A service that signs with its own domain will pass DKIM but fail DMARC. turn on custom domain authentication in that serivce. lmk how it goes

    2 8 helpful
  13. Sara Zhang
    @bytesmith

    authentication is necessary but not sufficient, if the content looks like spam or people never open the messages, Microsoft 365 inboxes will still junk them, clean lists matter as much as DNS.

    lol

    1 1 helpful
  14. Erik S.
    @eriks466

    ok so try turning off teh extension first, fixed it for me. following, having the same problem

    3 0 helpful
  15. Ada Torres
    @subnet_hound
    in reply to @shadergarage

    @shadergarage Turned on custom domain signing in the new marketing tool, DMARC now passes, and Gmail delivers normally again. Learned more about email this week than in ten years. owe u a beer 🍺

    0 5 helpful

Reply to this topic

Sign in or create an account to reply.