Google DMARC check: verify your domain meets Gmail's requirements

If Gmail returns 5.7.26, start with SPF, DKIM, and DMARC. If Gmail places mail in spam without that error, authentication is only one part of the diagnosis. Reputation, complaint rate, message format, and subscription practices also matter.

This guide follows Google’s current Email sender guidelines and sender guidelines FAQ. We verified it in August 2026.

In the domains we monitor, the DNS record often exists. The failure is alignment. A vendor passes SPF with its own return-path domain or signs with its own DKIM domain. The visible From address uses the customer’s domain, so DMARC still fails.

Gmail requirements in one table

Google introduced its current sender requirements on February 1, 2024. They apply to mail sent to personal Gmail accounts ending in gmail.com or googlemail.com.

Requirement	All senders	Bulk senders
SPF or DKIM	Required	Both required
DMARC	Recommended	Required. p=none is accepted
From-domain alignment	Recommended	SPF or DKIM must align for direct mail
Forward and reverse DNS	Required	Required
TLS	Required	Required
Spam rate below 0.3%	Required	Required
One-click unsubscribe	Not universal	Required for marketing and subscribed mail

Google treats a sender as bulk when it sends close to 5,000 or more messages to personal Gmail accounts in a 24-hour period. Messages from the same primary domain count together. Once Google classifies a sender as bulk, the classification is permanent.

How to run a Google DMARC check

Use our free domain checker for the DNS and policy layer. Enter the domain used in your visible From address.

Check these results:

1. SPF: One valid SPF record exists. It stays within the 10-query limit.
2. DKIM: Every sending platform publishes a working key and signs real mail.
3. DMARC: One record exists at _dmarc. Bulk senders need at least p=none.
4. Alignment: The SPF-authenticated domain or a passing DKIM d= domain aligns with the visible From domain.

A DNS check cannot confirm every Gmail requirement. Use Google Postmaster Tools to review spam rate and the Compliance dashboard. Inspect a delivered message or rejection to verify authentication for the exact mail stream.

What Google checks

Gmail evaluates SPF against the envelope sender. It verifies each DKIM signature against the selector and signing domain in that signature. DMARC then compares authenticated domains with the domain in the visible From: header.

DMARC passes when SPF or DKIM passes with alignment. Google requires bulk senders to configure both SPF and DKIM, but direct mail needs only one aligned identifier under the current requirement.

A DMARC pass does not guarantee inbox placement. A DMARC failure also does not map mechanically to one outcome. Receivers apply the published policy with their own filtering and override rules.

Common Google DMARC failures

The DMARC record is missing

Without a DMARC record, your domain does not publish a DMARC handling request or an aggregate-report destination. Gmail lists this as a compliance failure for bulk senders.

Create one TXT record at _dmarc:

v=DMARC1; p=none; rua=mailto:[email protected];

Use our DMARC generator to build the record.

DMARC stays at p=none

p=none satisfies Google’s minimum bulk-sender DMARC requirement. It is a monitoring policy. It does not request quarantine or rejection solely because DMARC failed.

Starting there is correct. Use the reports to prepare enforcement. Do not claim that Gmail requires p=quarantine or p=reject.

SPF passes but does not align

This is common with third-party senders. The Return-Path uses the vendor’s domain, so SPF passes without aligning with your From address.

Configure the vendor’s domain-authentication feature. Aligned DKIM is usually the cleanest fix. Some vendors also support an aligned custom return-path for SPF.

DKIM is missing or signs with the wrong domain

A valid DKIM signature can still be unaligned. Inspect the d= value. It must share the organizational domain of the visible From address under relaxed alignment.

Microsoft 365 requires custom-domain DKIM setup. See our Microsoft 365 DMARC guide. Google Workspace requires you to generate a key, publish it, and start authentication. See our Google Workspace DKIM guide.

SPF returns PermError

SPF allows at most 10 DNS-querying terms during one evaluation. Nested includes count. Too many vendors can push a record over the limit.

Use our SPF generator to check the complete lookup path. Remove obsolete services before adding another include.

How to fix a Gmail authentication failure

Use this order:

1. Run the domain through the DMARCTrust checker.
2. Confirm there is one SPF record and one DMARC record.
3. Send a real message through each platform.
4. Inspect SPF, DKIM, and DMARC results in the received headers.
5. Configure aligned DKIM for every third-party sender.
6. Add a DMARC aggregate-report address.
7. Review the Compliance dashboard and spam rate in Google Postmaster Tools.

Do not test only Google Workspace and assume the domain is complete. A CRM, helpdesk, event platform, or transactional service can use the same From domain with different authentication.

Move from monitoring to enforcement

Google accepts p=none, but enforcement provides stronger domain protection. Use report evidence, not a generic deadline:

1. Monitor with p=none until every normal sender appears.
2. Map each legitimate source.
3. Fix unaligned SPF or DKIM.
4. Use p=quarantine; t=y to request test mode.
5. Remove t=y when the report data is clean.
6. Consider p=reject only after testing the domain’s indirect mail flows.

RFC 9989, section 5.1 says legitimate unaligned streams must be remediated before enforcement. For domains with users who post to Internet mailing lists, section 7.4 recommends at least a month at p=none and another month at p=quarantine before considering p=reject.

DNS checks and DMARC monitoring solve different problems

A checker shows the records available now. Aggregate reports show what Gmail, Microsoft, Yahoo, and other participating receivers observed over time.

DMARCTrust groups those reports by source. It shows whether each source passed SPF, DKIM, and alignment. This is how you find a vendor that sends once a month or a legacy system that no DNS inventory recorded.

FAQ

Does Gmail require p=quarantine or p=reject?

No. Google’s current bulk-sender requirement accepts p=none. Use reporting to prepare enforcement, but do not claim that Gmail requires an enforcement policy.

Does a passing DMARC check guarantee Gmail delivery?

No. Authentication is required, but Gmail also evaluates reputation, spam rate, DNS, TLS, message format, and subscription practices.

How do I check a Gmail 5.7.26 error?

Inspect the error text and the failed message headers. Check SPF, DKIM, DMARC, and alignment for the exact sender. Then review the Compliance dashboard in Google Postmaster Tools if it is available for the domain.

Does Google require both SPF and DKIM alignment?

Not currently. Bulk senders must configure both SPF and DKIM. For direct mail, the From domain must align with at least one. Google’s FAQ recommends alignment with both for more reliable authentication.