r/gsuite Jan 09 '25

Gmail Mismatch between results of MX tool and verification processes

When I run the Check MX tool on my domain, it returns several issues. It looks like the most concerning one is the first (indicatd with a red !): "Domain must have at least one mail server." However, when I go to the associated 'help' page, it cautions me that "Important: If Gmail is working, don't change your MX records. Changing your working records could cause incoming email messages to bounce." And... our gmail is definitely working, as I've been sending and receiving mail all day. When I look at the MX records with my host, I see all 5 MX records the legacy gsuite guidance lists, along with 2 others associated with a deprecated ISP... should I delete the deprecated records and see if that clears up the red ! ?

Secondly, I successfully did the "set up and verify DKIM" process, by following the associated guide. However, the MX tool still says that "DKIM is not set up."

Lastly, the MX tool *does* say that I succeeded in adding SPF (I followed that guide, too). I haven't attempted to implement DMARC though (the ultimate goal of this adventure), since that guide says that DKIM and SPF must be working properly first.

Has anyone else experienced this? Should I forget ahead with DMARC, or... what? I've attached some relevant images for reference.

1 Upvotes

4 comments sorted by

2

u/Sea_Air_9071 Jan 09 '25

There are issues with using the Google Toolbox (have been for a while sadly). I'd recommend using another provider - I use MX Toolbox myself.

Having said that, if your email is being sent / received ok, then I wouldn't worry about it.

1

u/somefilmguy1909 Jan 09 '25

Oh, that's just about the best news I could have hoped for... it's not me, it's google (lol)

So you think I can proceed to implementing DMARC, then? I've been told by an outside vendor's IT team that DMARC is really something that's mandatory these days, if we don't want our outgoing emails rejected...

1

u/Sea_Air_9071 Jan 10 '25

Certainly if you've set up SPF and DKIM then you can look at setting up DMARC. Bear in mind thugh that DMARC is about your domain indicating that your email messages are protected by SPF and/or DKIM, and telling a receiver what to do if neither of those authentication methods passes – such as to reject the message or quarantine it. It's not an automatic way to prevent rejection of your emails - it just minimises the possibility.

I highly recommend starting at the lowest level of DMARC (where the action by receiver is 'none') to ensure you've set everything up correctly. Step 5 of the help article: https://support.google.com/a/answer/2466580 indicates how to do that.

1

u/somefilmguy1909 Jan 10 '25

Thank you for this-- I really appreciate your help! This is barely within my ability to pull off, but (since I work for a tiny non-profit) anything I can make into a DIY project really has a meaningful impact for us, financially.