A DMARC failure does not always mean Google Workspace failed to send the message. Check both authentication and alignment: a valid SPF or DKIM result must align with the visible From domain under the domain’s policy.
Identify the actual sending stream
Review aggregate reports and representative recipient-side headers. Separate direct Workspace mail from a marketing service, help desk, website, gateway, or forwarded message that also uses your domain.
For SPF, examine the envelope sender domain, not just the visible From address. For DKIM, inspect the signature’s d= domain. A third-party provider can authenticate its own domain successfully while failing to align with your organization’s From domain.
Repair the legitimate stream before enforcing more
Confirm that each approved provider uses the intended authentication and domain configuration. DMARC passes when an aligned SPF check or an aligned DKIM check succeeds; both do not have to pass for every individual message.
Google recommends beginning a new DMARC rollout with monitoring and reviewing reports before progressing to quarantine or reject. Strict alignment can reject mail from associated subdomains that would satisfy relaxed alignment, so do not tighten those tags without checking the real routes.
Keep spoofing and legitimate failures separate
Some failing report entries may be unauthorized spoofing rather than a service you should add to SPF. Verify ownership and business authorization before expanding the policy. Protect report data and use a suitable dedicated report destination.
Retest Workspace and every legitimate external sending service after a correction. Save the prior DNS record and monitor the effect through the relevant propagation period. Do not remove DMARC entirely or authorize unfamiliar infrastructure simply to reduce the number of red entries in a dashboard. A stricter policy is useful only when it reflects the organization’s verified sending paths and does not silently disrupt legitimate mail.
Browse Gmail & Google Account help
References
Reviewed against the linked product guidance, standards, and identified vendor or public-authority guidance on October 29, 2026. Available options and screen labels can vary by account, device, region, and organization policy.