Using Gmail SMTP server but DMARC p=reject is set in my domain

Question

I have a website hosted on a VPS server. I have the domain setup so incoming mails will still be hosted in the VPS server too. Except the SMTP server I'm using is Gmail since Gmail's sending IP reputation is much more reliable so recipients are more likely to receive my mails without going to their Spam folder.

I recently implemented a DMARC policy of p=reject, but I noticed that if this is done, mail servers at the receiving end will reject and bounce these emails since it will fail alignment.

Is there any workaround for this? I mean is there a way to pass DMARC if you are using Gmail SMTP server?

Answer 1

This is your problem:

I recently implemented a DMARC policy of p=reject

Use a less strict rule for testing until you can confirm everything works as expected. Something like this will give you emailed reports of any problems so you know what to fix:

v=DMARC1; p=none; rua=mailto:[email protected];

Use an online DMARC policy generator to create your policy, they explain each step as you create it. I use and recommend the one at https://dmarcian.com/dmarc-record-wizard/ (no affiliation, I just like that it is free and simple to use).

You can revert to a stronger policy once you have everything tested and working. For example, I use v=DMARC1; p=reject; adkim=s; aspf=s; with my domains which is very strict and does not generate any error reports if there is a problem. It works really well once all the necessary DNS records are tested and working.

Answer 2

Passing DMARC actually comes down to passing SPF or DKIM, preferably both, aligned with your header.from domain.

SPF is checked on the domain used in your return-path address, which is generally set in your SMTP server, before relaying via Google. It might be the same as your header.from but is not necessarily so.

If you control the domain in the return-path address, you should set up an SPF record that includes Google's SMTP servers. GSuite users need to add include:_spf.google.com to their record, somewhere after v=spf1 and before ~all or -all. Be careful though, because adding it will add 4 DNS lookups to your SPF record. Your SPF record would look like this if you only send out emails via Google's SMTP service:

v=spf1 include:_spf.google.com ~all

Remember to edit it when you start using different services.

Additionally you could add DKIM signing on your SMTP server, so messages are signed before routed via Google's SMTP servers. DKIM is checked on the domain in the header.d header, which should align with your sending domain.

As Tom pointed out, you can add a rua: tag to your DMARC policy to receive reports on the use and abuse of your domain. You can check a test message's headers to find out the return-path and optionally the DKIM signing information.