'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Gmail Rejections by Configuring SPF and DKIM
Question details
The user needs to configure SPF and DKIM DNS records to stop Gmail from rejecting emails sent from their custom domain.
- Product
- Domain DNS / Email Server
- Device & OS
- not provided
- Scenario
- Sending outbound emails to Gmail users and experiencing bounce backs or rejections due to strict sender security policies.
- Observed behavior
- Messages are rejected by Gmail servers because they fail authentication checks, usually due to missing or misconfigured SPF and DKIM records.
Ensure you have administrative access to your domain's DNS manager (such as Cloudflare, Route 53, or GoDaddy) and your email service provider's admin console.
Configure SPF and DKIM Records in Your DNS
Publishing the correct SPF and DKIM records proves to Gmail that your emails are authorized and untampered, resolving security rejections.
SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are standard email authentication methods. SPF dictates which servers can send emails on your behalf, while DKIM securely signs outgoing messages.
For services like Microsoft 365, always use the specific records provided in their administrative portal (e.g., Microsoft Defender) rather than generating third-party keys.
Log in to your email provider's admin portal (e.g., Microsoft 365 Defender portal or Google Workspace Admin). Locate the email authentication settings to find the required SPF string and DKIM TXT or CNAME records.
Open your domain registrar's DNS management page. Add a new TXT record at the root level (@) and paste the SPF value provided by your email host (for example, 'v=spf1 include:spf.protection.outlook.com -all').
In the same DNS management page, create the new TXT or CNAME records for DKIM using the exact selectors and key values supplied by your email provider.
Return to your email provider's admin portal and toggle the setting to enable DKIM signing for outgoing messages on your domain.
Allow up to 48 hours for the DNS changes to fully propagate across the internet. Once propagated, verify the setup using your provider's built-in check tool, and send a test email to a Gmail address.
A Lightweight Alternative for Your Business Documents
While you optimize your domain's email deliverability, consider upgrading your document workflow. WPS Office provides a free, lightweight, and user-friendly alternative to expensive office suites, letting you focus on your business instead of complex software configurations.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the downloaded installer file and follow the simple on-screen instructions to complete the setup.
- 3. Start Creating: Open WPS Office to instantly begin editing Word, Excel, PowerPoint, and PDF files.
Frequently Asked Questions
What is the difference between SPF and DKIM?
SPF specifies which mail servers are authorized to send email on behalf of your domain. DKIM adds a digital signature to outgoing emails to prove to the receiving server that the message was not altered in transit.
Can I have multiple SPF records on one domain?
No, a single domain can only have one SPF TXT record. If you use multiple email sending services, you must merge their rules into one single SPF record using the 'include' mechanism.
Why are my emails still bouncing after adding the records?
DNS changes can take up to 48 hours to fully propagate worldwide. Additionally, ensure there are no typos in your DNS records and that you have actively enabled DKIM signing in your email provider's admin console.
