MailBrother
Add to Chrome
Documentation

SPF, DKIM and DMARC for Gmail bulk senders

If you send from your own domain (Google Workspace), Gmail, Outlook and Yahoo check three DNS records before they trust your mail: SPF, DKIM and DMARC. Since 2024 Google requires all three for anyone sending more than a few thousand emails a day, and mail without them lands in spam far more often at any volume. Personal @gmail.com addresses are signed by Google automatically; nothing to do there.

Where to see your status: MailBrother checks your domain every day and shows the result at the top of MailBrother → Campaigns in Gmail. Green on all three means you are done.

1. SPF: who may send for your domain

Add a TXT record at the root of your domain (host @):

v=spf1 include:_spf.google.com ~all

If an SPF record already exists, do not add a second one: put include:_spf.google.com inside the existing record. SPF allows at most 10 DNS lookups in total, so keep the list of includes short.

2. DKIM: a signature on every email

  1. Open the Google Admin console → Apps → Google Workspace → Gmail → Authenticate email.
  2. Select your domain and click Generate new record (2048-bit, selector google).
  3. Create the TXT record shown there at your DNS provider: host google._domainkey, value starting with v=DKIM1; k=rsa; p=….
  4. Wait up to 48 hours for DNS, then click Start authentication.

3. DMARC: what to do when checks fail

Add a TXT record at host _dmarc:

v=DMARC1; p=none; rua=mailto:[email protected]

Start with p=none (monitor only). After a few weeks of clean reports move to p=quarantine, then p=reject. The rua address receives daily XML reports; a free service such as dmarcian or Postmark's DMARC tool turns them into a readable dashboard.

Check it

Send an email from Gmail to mail-tester.com or open any received email in Gmail → ⋮ → Show original: the summary at the top must say SPF: PASS, DKIM: PASS, DMARC: PASS.

Common mistakes

  • Two SPF records on one domain: receivers treat this as a permanent error. Merge them.
  • DKIM record generated but "Start authentication" never clicked in the Admin console.
  • DNS provider added quotes or split the long DKIM value incorrectly. Paste it as one value.
  • Sending from a Google Workspace alias on a domain you have not verified in the Admin console.
  • Using a brand-new domain: age matters. Warm it up with small daily volumes for two to three weeks and keep 30-60 seconds between emails (the default in MailBrother).

Still red after 48 hours? Write to [email protected] with your domain name.