Email Authentication Explained: Why Gmail Rejects Your Email

SPF: who’s allowed to send as you

Sender Policy Framework is a DNS TXT record that lists which mail servers are authorized to send email claiming to be from your domain. When a receiving server gets mail "from" yourdomain.com, it checks your domain’s SPF record to see if the sending server’s IP is on the approved list. If it isn’t, that’s a red flag — it looks exactly like someone spoofing your domain.

This is why adding a new sending provider (like MailCraft) requires a DNS change: you’re telling the world "yes, this provider is authorized to send as me."

DKIM: proof the message wasn’t altered

DomainKeys Identified Mail adds a cryptographic signature to each outgoing email, generated with a private key your sending provider holds. The receiving server looks up your public key (published in DNS) and verifies the signature matches. If it does, the receiver knows two things: the message really was signed by someone holding your private key, and nothing in the signed content was altered in transit.

Unlike SPF, which checks the sending server, DKIM checks the message itself — which is why it survives being forwarded through servers SPF wouldn’t recognize.

DMARC: the policy that ties them together

Domain-based Message Authentication, Reporting and Conformance is a DNS record that does two things: it tells receiving servers what to do when a message fails both SPF and DKIM alignment (nothing, quarantine it, or reject it outright), and it gives you an email address to receive aggregate reports showing who’s sending mail claiming to be from your domain — including anyone spoofing it.

A DMARC policy of "none" just monitors and reports. "Quarantine" tells receivers to send failing mail to spam. "Reject" tells them to bounce it outright. Most domains should start at "none," review the reports for a few weeks to make sure all legitimate senders pass, then move to "quarantine" and eventually "reject."

Why Gmail specifically is strict about this

Google (and increasingly other major providers) require SPF and DKIM to pass, and a DMARC record to exist, for any domain sending more than a small daily volume to Gmail addresses. This isn’t Gmail being arbitrary — it’s a direct response to how much phishing relies on spoofed sender domains. If you’re seeing rejections specifically from Gmail with volume above a few hundred messages a day, authentication gaps are the first thing to check, not spam content.

How this works in MailCraft

When you add a domain in MailCraft, we generate its DKIM and DMARC records — you copy them into your DNS provider and we check when they’re live. Mail goes out through Amazon SES, whose return path handles SPF, so once DKIM verifies your outgoing mail is authenticated and eligible for the best inbox placement your content and reputation can earn.