Proudly Canadian 
If your business emails are landing in spam folders, getting silently rejected, or failing authentication checks, there is a good chance DMARC alignment is the culprit. It is one of the most common and most misunderstood email deliverability problems we deal with for clients, and the error messages involved rarely tell you what is actually wrong.
This guide covers everything you need: what DMARC alignment actually means, how SPF and DKIM fit into the picture, and exactly how to configure all three correctly in Google Workspace, including when you are also using third-party services like Mailgun, SendGrid, or any marketing platform that sends on your behalf.
Quick Fix Summary
- Verify your SPF record includes
include:_spf.google.comand all third-party senders - Generate and publish a DKIM key in Google Workspace Admin Console
- Ensure the domain in your From address matches your SPF and DKIM domains exactly
- Publish a DMARC TXT record starting with
p=noneto monitor without blocking mail - Review DMARC aggregate reports and tighten policy to
p=quarantineorp=rejectover time
Understanding the Three Pillars: SPF, DKIM, and DMARC
Before jumping into fixes, it is worth understanding how these three protocols work together. Each serves a distinct function, and DMARC depends on both of the others to do anything useful.
What is SPF?
SPF (Sender Policy Framework) is a DNS record that lists all the mail servers authorized to send email on behalf of your domain. When a receiving server gets an email from you, it checks your DNS to see if the sending server's IP is on the approved list.
An SPF record looks like this:
v=spf1 include:_spf.google.com include:sendgrid.net ~all
The ~all at the end is a soft fail, meaning receiving servers accept the email but flag it. Using -all is stricter and will outright reject unauthorized senders.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a cryptographic digital signature to every email your server sends. The receiving server retrieves your public key from DNS and uses it to verify the signature, confirming the email has not been tampered with in transit and genuinely came from your domain.
A DKIM record in DNS looks like this:
google._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0B..."
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is the policy layer on top of SPF and DKIM. It tells receiving mail servers what to do when an email fails authentication, and it introduces the concept of alignment.
v=DMARC1; p=none; rua=mailto:[email protected]
What does alignment mean?
This is where most DMARC failures happen. Alignment means the domain in the email's visible From header must match the domain used in SPF or DKIM authentication. There are two modes:
- Relaxed alignment (default): Subdomains are allowed.
mail.yourdomain.comaligns withyourdomain.com. - Strict alignment: Domains must match exactly.
mail.yourdomain.comdoes not align withyourdomain.com.
DMARC passes if at least one of SPF or DKIM is both valid and aligned with the From domain. If neither passes alignment, DMARC fails, and your policy determines what happens next.
How to Diagnose a DMARC Failure
Before making any changes, you need to understand what is actually failing. Blind changes to DNS records can make things worse.
Check your DMARC reports
If you already have a DMARC record with a reporting address (rua=), major mail providers are sending you XML aggregate reports. These reports tell you exactly which IPs are sending on your behalf and whether SPF and DKIM are passing or failing. Tools like MXToolbox DMARC Analyzer, Postmark's DMARC Digests, or Google Postmaster Tools can parse these XML reports into readable dashboards.
Inspect email headers
Open a failing email in Gmail and select Show Original from the three-dot menu. Look for these headers:
Authentication-Resultsshows SPF, DKIM, and DMARC pass or fail statusReceived-SPFshows whether SPF passed and which IP was checkedDKIM-Signatureis present if DKIM was applied; check thed=tag matches your From domain
A DMARC failure in the headers looks like: dmarc=fail (p=none dis=none) header.from=yourdomain.com
Use online DNS lookup tools
Use MXToolbox or Google Admin Toolbox at toolbox.googleapps.com to check your current SPF, DKIM, and DMARC records. Look for an SPF record missing Google or third-party senders, a DKIM record that was never published, or no DMARC record at all.
Step-by-Step Fix for Google Workspace
Step 1: Verify and Update Your SPF Record
Log in to your domain registrar or DNS management panel. If your domain is managed through our platform, you can find this under My Domains in your WHMCS client area. Look for an existing TXT record at the root of your domain. You should only have one SPF record, multiple SPF records on the same domain will cause failures.
If you only use Google Workspace to send email:
v=spf1 include:_spf.google.com ~all
If you also use other services, add each one:
v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all
SPF has a limit of 10 DNS lookups. If you include too many services, your SPF record may exceed this and start failing. Use MXToolbox's SPF checker to count your lookups before publishing.
Step 2: Enable DKIM in Google Workspace
DKIM is not enabled by default in Google Workspace. You must generate and publish the key manually.
- Sign in to your Google Workspace Admin Console at admin.google.com
- Navigate to Apps, then Google Workspace, then Gmail, then Authenticate email
- Select your domain from the dropdown
- Click Generate new record and choose 2048-bit key length
- Copy the TXT record name and value provided
- Add this TXT record to your DNS with the host set to
google._domainkeyand the value being the long string starting withv=DKIM1; k=rsa; p=... - Wait for DNS propagation, then return to Admin Console and click Start authentication
To verify DKIM is working, send a test email to any Gmail address, open it, and check the headers for dkim=pass.
Step 3: Verify Domain Alignment
This is the most commonly skipped step. Even with SPF and DKIM correctly configured, DMARC can still fail if the domains do not align.
Check the following: your From address uses [email protected] and not a subdomain or alias unless you have configured DKIM for that subdomain separately. The DKIM signature's d= tag should match yourdomain.com. The SPF envelope-from, also called the Return-Path, should also align with your From domain.
A common misalignment scenario: you set up Google Workspace on yourdomain.com, but your email automation tool sends using bounce.yourdomain.com or its own domain entirely. Those emails will fail DMARC alignment unless you configure DKIM on those services as well.
Step 4: Publish a DMARC Record
Add a TXT record to your DNS at the host _dmarc, making the full record name _dmarc.yourdomain.com.
Start with monitoring mode:
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
The p=none tag means monitor only with no action taken on failures. The rua address receives daily aggregate reports. The ruf address receives per-failure forensic reports. The fo=1 tag sends forensic reports whenever either SPF or DKIM fails.
After reviewing reports for two to four weeks and confirming alignment, move to enforcement:
v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]
Then, once you are confident everything is aligned:
v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]
Configuring DMARC for Third-Party Email Services
Many businesses use Google Workspace alongside other tools that send email on their behalf: marketing platforms, CRMs, transactional email services, support ticketing systems. Each of these must be properly configured to maintain DMARC alignment.
The preferred approach is to configure custom DKIM signing on each third-party service. Most reputable services including Mailchimp, SendGrid, Mailgun, and HubSpot support this. You add a CNAME or TXT record they provide to your DNS, which allows them to sign outgoing emails with your domain.
If you would rather not configure DKIM on every third-party tool, the alternative is to send from a subdomain. Instead of sending marketing emails from [email protected], send from [email protected] and configure SPF and DKIM specifically for that subdomain. This keeps your primary domain's reputation isolated.
Common SPF includes for third-party services:
- SendGrid:
include:sendgrid.net - Mailgun:
include:mailgun.org - Mailchimp:
include:servers.mcsv.net - HubSpot:
include:hubspotemail.net - Zendesk:
include:mail.zendesk.com - Microsoft 365:
include:spf.protection.outlook.com
Managing DNS Records via WHMCS
If your domain is registered or your hosting is managed through our client portal, you can update all DNS records directly without needing to access a separate control panel. Navigate to My Domains, click Manage next to the relevant domain, and select DNS Management. All SPF, DKIM, and DMARC records use the TXT record type.
For SPF, set the host to @ and the value to your full SPF string. For DKIM, set the host to google._domainkey and the value to the key string copied from Google Admin Console. For DMARC, set the host to _dmarc and the value to your policy string.
If you do not see a DNS management option in your client area, contact our support team as DNS management may need to be enabled for your account.
Common Causes of DMARC Failure
Multiple SPF records on the same domain
Only one SPF record is permitted per domain. If you have two TXT records both starting with v=spf1, the result is undefined and will cause failures. Merge all includes into a single record.
DKIM never enabled in Google Workspace
Google Workspace does not enable DKIM automatically at setup. If this step was skipped, every email leaves your server unsigned and DMARC alignment via DKIM will always fail.
DKIM key not yet propagated
After publishing the DKIM TXT record, Google Workspace may show that it cannot find the key if propagation has not completed. Wait up to 48 hours and verify the record is publicly visible using MXToolbox before clicking Start authentication.
Outdated DNS records after migration
Migrating to Google Workspace from another provider without cleaning up old SPF includes and DKIM records is one of the most common causes of intermittent failures. The old provider's records remain in DNS and create authentication confusion. Remove everything from the previous provider once Google Workspace is confirmed working.
Third-party tool sending without DKIM alignment
A CRM, marketing tool, or transactional email service is sending on your behalf using its own domain, causing the From address to mismatch with the DKIM signing domain. Configure custom domain DKIM signing on that service or move those sends to a dedicated subdomain.
Email forwarding breaking SPF
SPF was not designed to survive email forwarding. When a message is forwarded through a relay, the sending IP changes and SPF fails. DKIM is more resilient in this scenario since the signature travels with the message. If forwarding is involved, rely on DKIM as your primary alignment mechanism.
How to Verify Everything is Working
After making your changes, wait for DNS propagation and then verify using the following methods.
Send a test email to mail-tester.com. The tool gives you a score out of 10 and shows exactly what passed and failed, including SPF, DKIM, and DMARC alignment.
Use Google Admin Toolbox at toolbox.googleapps.com and run the Check MX tool against your domain. It flags common configuration errors and shows the full content of your DNS records.
Send yourself a test email and check the raw headers. You want to see dkim=pass, spf=pass, and dmarc=pass in the Authentication-Results header. All three should show pass before you consider the configuration complete.
Pro Tips from Real Deployments
Do not rush to p=reject. Start with p=none, review reports for two to four weeks, then move to p=quarantine before going to p=reject. Skipping this process can block legitimate emails from services you forgot were sending on your behalf.
Use subdomain isolation for transactional and marketing email. Sending from [email protected] instead of your root domain keeps any deliverability issues from those streams away from your primary domain's reputation.
Lower your TTL before making changes. Set it to 300 seconds a day before any DNS edits. This speeds up propagation and makes rollbacks faster if something goes wrong.
Monitor Google Postmaster Tools at postmaster.google.com. It shows you how Gmail sees your domain's reputation, DMARC compliance, and spam rates for free. It is one of the most underused tools available to domain owners.
Every time you onboard a new SaaS tool that sends email on your behalf, go back and review your SPF record. It is easy to forget, and a service sending unauthenticated mail from your domain can quietly damage your reputation for months before you notice.
When to Contact Support
Most DMARC alignment issues resolve once DNS is corrected and DKIM is properly enabled. But some situations do require deeper investigation: inconsistent failures that only affect certain recipients, SPF lookup counts exceeding the 10-lookup limit, DKIM signature verification failures despite correct DNS records, or complex multi-domain environments where alignment is difficult to trace.
If you have worked through the steps above and are still seeing failures, open a support ticket from your client area and include a sample email header. The header alone contains enough information to identify the root cause in most cases and cuts diagnosis time significantly.
Why Google Workspace Does Not Send RUF Forensic Reports (and What To Do Instead)
If you have a DMARC record that includes an ruf= tag pointing to a reporting address, you may have noticed that Google Workspace never sends forensic reports to that address. This is not a misconfiguration on your end. Google Workspace deliberately does not send RUF forensic reports at all, to any address, regardless of how your DMARC record is structured. This is Google's stated policy and it applies to all Google Workspace domains.
RUF reports, also called forensic reports, are message-level reports that contain headers or redacted content from individual emails that failed DMARC. Because they can contain sensitive message data, many providers including Google have chosen not to generate them. Google only sends RUA aggregate reports, which summarise authentication results across all your sending sources over a 24-hour window without including message content.
The practical implication is that if you are relying on RUF reports to diagnose specific DMARC failures for Google Workspace senders, you will not receive them. What you will receive are RUA aggregate reports, which contain enough information to identify which sending sources are failing and why.
What to configure instead
Make sure your DMARC record includes an rua= tag with a valid reporting address. Google Workspace will send aggregate reports to this address. A basic DMARC record with aggregate reporting looks like this:
v=DMARC1; p=none; rua=mailto:[email protected]
Because RUA reports are in XML format and difficult to read directly, use a DMARC report parsing service to make them actionable. Options that work well with Google Workspace aggregate data include Postmark DMARC Digests, Dmarcian, MXToolbox DMARC reporting, and Google's own Postmaster Tools, which provides deliverability and authentication data specifically for mail sent to Gmail recipients.
Google Postmaster Tools is particularly useful for Google Workspace senders because it shows your domain's spam rate, IP reputation, and DMARC authentication pass rate as seen by Gmail. To set it up, navigate to postmaster.google.com, add your domain, and verify ownership via a DNS TXT record. Once verified, the dashboard populates within a few days of sending activity.
If you are seeing DMARC failures in your aggregate reports and cannot isolate which source is responsible because you lack forensic detail, the aggregate report's source ip field combined with a reverse DNS lookup on that IP is usually sufficient to identify the sending service. From there you can configure DKIM for that service or add its sending infrastructure to your SPF record to bring it into alignment.
Gotekky
Need help deciding what to do next?
Tell us what you are seeing and what outcome you need. We will identify whether a managed service, scoped project or paid technical assessment is the right next step.