Google Workspace DMARC Problems
DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM checks, and where to send reports about authentication activity for your domain. A DMARC policy set too strictly, before SPF and DKIM are fully correct, can cause legitimate mail to be rejected.
Common Causes
- No DMARC record published at all, leaving receiving servers to apply their own default handling.
- A policy of "reject" or "quarantine" set before SPF and DKIM were fully and correctly configured.
- Legitimate third-party senders (like marketing tools) not aligned with SPF/DKIM, causing DMARC failures for real mail.
- No reporting address configured, making it hard to see what DMARC is actually doing.
- Subdomains not covered by the policy, or covered unintentionally by an overly broad one.
Safe Troubleshooting Steps
- Check whether a DMARC TXT record exists at _dmarc.yourdomain.com.
- If none exists, start with a monitoring-only policy (p=none) with a reporting address, rather than jumping to enforcement.
- Review DMARC reports over a few weeks to see which sources pass and fail authentication.
- Fix any legitimate senders failing SPF or DKIM before tightening the policy.
- Move to a stricter policy (quarantine, then reject) gradually once reports show clean results.
What Our Support Can Cover
- Reviewing whether a DMARC record exists and what it currently does
- Interpreting DMARC aggregate reports
- Recommending a safe rollout path from monitoring to enforcement
- Coordinating DMARC changes with SPF/DKIM fixes
Frequently Asked Questions
Should I go straight to a reject policy?
Generally no. Starting with p=none lets you monitor what is happening with your mail authentication before you risk blocking legitimate messages, including your own.
What is a DMARC report and do I need to read it manually?
DMARC reports are XML files sent by receiving mail providers summarizing authentication results. They are not easy to read manually at scale, but reviewing them periodically (or with a reporting tool) helps confirm your policy is working as intended.