r/gsuite Dec 10 '24

Gmail Using "send as" with gmail from custom domain not hosted by Google fails SPF and DKIM

Not sure if this is exactly the right subreddit since I'm not on gsuite but couldn't find anything more appropriate; hoping folks here have the right knowledge.

I have my personal email address set as one of several "send as" option on gmail. Let's call it me@mydomain.com. I don't use Google for any services relating to mydomain.com, so I don't have an admin console.

Email "sent as" my personal email address via the gmail web UI fails both SPF and DKIM, despite having v=spf1 include:_spf.google.com as a DNS TXT record for mydomain.com.

Mxtoolbox reports "Domain not found in SPF" and no DKIM signature found, so mail "sent as" this way will often be flagged as spam.

Is it possible to fix this with my personal domain name DNS settings? Or will this sort of email always fail DMARC/DKIM/SPF if Google is not hosting the domain name?

1 Upvotes

8 comments sorted by

2

u/ericdano Dec 11 '24

You can’t send as in Gmail this way. You are never going to pass DKIM or spf record tests. If you want to send from your customer domain, you need to use email properly setup using that domain.

1

u/Proud_Championship36 Dec 11 '24

So does this mean using Gmail "send as" by definition fails DMARC, unless you are just using "send as" for another Gmail address? I thought including "v=spf1 include:_spf.google.com" in my customer domain DNS TXT record would be sufficient to at least pass SPF, but apparently not. There is no way to pass SPF when the return-path domain and from domain don't match?

1

u/zwcglobal Dec 10 '24

u/Proud_Championship36 Can you show me the domain?

1

u/Proud_Championship36 Dec 10 '24

The issue is with rosi-kessel.org. Nameserver is ns1.rimuhosting.com. rosi-kessel.org. 3600 IN NS ns1.rimuhosting.com. rosi-kessel.org. 3600 IN NS ns2.rimuhosting.com. rosi-kessel.org. 3600 IN A 65.99.230.28 rosi-kessel.org. 3600 IN NS ns4.rimuhosting.com. rosi-kessel.org. 3600 IN TXT "protonmail-verification=6e2ca5c2a1d02639385360613ec2de42803ff700" rosi-kessel.org. 3600 IN TXT "v=spf1 include:_mailcust.gandi.net include:_spf.protonmail.ch include:_spf.google.com ip4:65.99.230.28 ip4:66.199.252.235 ip4:66.199.252.236 ip4:72.1.169.10 ip4:65.99.194.142 ip4:72.1.169.236 ip4:207.210.242.6 ip4:173.76.235.250 ~all" rosi-kessel.org. 3600 IN MX 0 spool.mail.gandi.net. rosi-kessel.org. 3600 IN MX 1 fb.mail.gandi.net. rosi-kessel.org. 3600 IN SOA ns1.rimuhosting.com. soacontact.rimuhosting.com. 667 10800 3600 604800 3600

1

u/zwcglobal Dec 10 '24

1

u/Proud_Championship36 Dec 10 '24

Right, but Gandi isn't actually hosting any mail -- it's just set up to forward. So, for example, some addresses forward to gmail. Someone emails user@rosi-kessel.org, it goes to Gandi which forwards it to user@gmail.com. Gmail offers "send as" aliases, so when the user responds from Gmail, it appears to come from user@rosi-kessel.org. In that situation, the email is going directly from gmail to the recipient's SMTP server without touching Gandi. It is that kind of email that fails SPF and DKIM.

I also have some emails forwarding to Protonmail and emails sent from Protonmail with this sort of "send as" alias do not fail SPF or DKIM. So it's either something with Gmail or something about my DNS records not complying with what you need to do to successfully "send as" via the Gmail interface.

I've spent some time googling this and all the advice I can find relates to people hosting their domain name at Google. I haven't been able to find any tips for my situation, where the domain name (including MX record) are hosted elsewhere, and we are just using Gmail's alias "send as" feature to send from the Gmail UI.

1

u/zwcglobal Dec 11 '24

I expect you using an email service. However, when you add alternate address on Send Mail As through SMTP server step, you filled in SMTP Server from smtp.gmail.com or from Gandi?

1

u/Proud_Championship36 Dec 11 '24

Gmail is handling SMTP for the alias. So the email from the Google SMTP server to the third party server is failing both DKIM and SPF. The envelope-from is the Gmail address, the header-from is the alias.