Fix
Google Workspace mail failing DMARC
A DMARC fail on Google Workspace mail means neither SPF nor DKIM aligned with the visible From domain. Alignment, not a plain SPF or DKIM pass, is what DMARC evaluates, so mail relayed by a third-party sender can pass SPF against its own envelope domain and still fail DMARC outright. SPF also allows a maximum of 10 DNS lookups.
| Pass condition | SPF or DKIM must pass and align with the From domain |
|---|---|
| DKIM key | 2048-bit key generated and published per sending domain |
| SPF lookups | Hard limit of 10 DNS lookups per evaluation |
| Common cause | Third-party senders using their own envelope domain |
| Safe rollout | p=none with reporting, then quarantine, then reject |
Alignment is the part people miss
A marketing platform sending on your behalf usually passes SPF against its own envelope domain. DMARC does not care: it requires the passing mechanism to align with the domain shown to the recipient, so that mail fails unless DKIM is signed with your domain's key.
Enable DKIM for every sending domain in the Admin console, publish the key, and require your third-party senders to sign with a subdomain of yours. That single change resolves most fails we investigate.
Roll out without losing mail
Start at p=none with an aggregate reporting address and read a fortnight of reports before tightening. The reports name every sender using your domain, including the ones nobody remembered authorising.
Move to quarantine next, then reject, and set a subdomain policy explicitly. A domain without sp= leaves every subdomain unprotected, which is the gap spoofers use once the parent domain is locked down.
- Keep SPF under the 10-lookup limit or evaluation fails permanently.
- Publish DKIM for every domain and subdomain that sends.
- Set sp= explicitly rather than relying on inheritance assumptions.
What we see that others don't say
The domains we review that already publish DMARC most often fail on subdomains rather than the parent, because sp= was never set and every unused subdomain remained spoofable after the main domain was locked down.
What this doesn't cover
- We configure DNS records and Workspace settings; we do not control third-party senders' own signing configuration.
- Report interpretation depends on receivers sending aggregate reports, which not all do.
Questions we get asked
- Why does mail pass SPF but fail DMARC?
- Because DMARC requires alignment. If SPF passes against a third party's envelope domain rather than the domain in the visible From header, DMARC records a fail even though SPF itself passed.
- Should I go straight to p=reject?
- No. Start at p=none with reporting for at least two weeks, identify every legitimate sender in the aggregate reports, then move to quarantine and finally reject once nothing legitimate is failing.
How this page is verified
Reviewed by Pearl Lemon Cloud security desk, Workspace security and compliance reviewers. Last checked .
- Alignment behaviour verified against aggregate DMARC reports for client domains at the review date.
- SPF lookup limit confirmed against the published SPF specification.
Sources you can check
Related pages
Want DMARC at reject without breaking mail?
We run the reporting period, identify every legitimate sender, and take the domain to enforcement on a dated schedule.