Why important emails never arrive: SPF, DKIM and DMARC in order

“The client says they sent the email, but we never received it.” “Our proposals land in the recipient’s spam.” The two most common email complaints among Google Workspace users, and in both cases the culprit is usually not Gmail. It is DNS records that were never finished.

The three records that decide everything

• SPF declares which servers may send mail for your domain. One TXT record with include:_spf.google.com for Gmail, plus an include for every other system that sends as your domain (CRM, invoicing, newsletters), so inventory your senders first. Critically: a domain may have only one SPF record. Two SPF records are as bad as none.
• DKIM is a cryptographic signature proving the message was not altered in transit. Check its status in the Admin console (Apps, Google Workspace, Gmail, Authenticate email). If your domain is not authenticating email, generate the key there, add it to DNS and start authentication. Until then Gmail signs with a generic Google key, not your domain, which matters for DMARC.
• DMARC tells receivers what to do with mail that fails the checks. Start with p=none, read the reports for a few weeks to catch senders you forgot, then move to quarantine and only later to reject. Google’s guide: Set up DMARC.

How DMARC actually decides

DMARC does not need three separate green ticks. It passes when at least one of SPF or DKIM passes and that result is aligned with the domain in the From address. Example: your invoicing tool sends as invoices@yourcompany.com but signs with its own key for mailer.invoicetool.com and uses its own SPF domain. Both checks pass, neither is aligned with yourcompany.com, so DMARC fails and a reject policy drops the invoice. Set up both SPF and DKIM for every sender anyway: SPF breaks on forwarding, DKIM survives it.

Do not trust diagnostic tools alone

Toolbox checkers show warnings when everything is fine and vice versa. The reliable test is simple: send a message from your domain to an account on another service, open it, view the original. You want PASS on DMARC, backed by an aligned PASS on SPF or DKIM, with the DKIM signing domain being your own. A FAIL or NONE on DMARC, or a signature from a domain that is not yours, and you have found the problem.

One caveat: authentication makes you a trusted sender, it does not guarantee the inbox. Content, volume and complaint rates still count; see Google’s email sender guidelines.

Incoming mail that never arrives

Your own SPF and DKIM protect what you send. When a client’s message to you disappears, check in this order:

• Ask the sender for the bounce message, the exact address and the time sent. A typo or a rejection notice ends the search.
• Run Email Log Search in the Admin console for that address and time window. It shows whether the message reached Google at all and what happened next. Use it first, not last.
• Check the admin quarantine and any Compliance or Content rules, set up once and forgotten.
• A stale MX record still pointing at the previous mail server, or a routing rule sending mail elsewhere.
• Contact forms on your website sending mail with the customer’s address as the sender. Google treats that as spoofing. The form must send from your domain with the customer in Reply-To.

And no, Outlook is not the fix

When mail misbehaves, someone always suggests switching clients. If the root cause is DNS, a quarantine or a routing rule, the client changes nothing. Authentication is part of every Workspace setup we do: fix the records, test with a real message, read the DMARC reports, then tighten the policy.

Still losing mail or landing in spam? We review the affected mail flow, every system that sends as your domain and the SPF, DKIM and DMARC records, then test real messages. Book a free 30-minute audit or call +371 22 30 50 90.

Request an email review