How do I align SPF authentication with my sending domain in Google Postmaster Tools?
Updated on 19 Oct 2026: We clarified how to verify SPF alignment in Google's authentication views and corrected the DNS troubleshooting advice.
To make SPF authentication match your sending domain in Google Postmaster Tools, configure your email service provider (ESP) so the envelope sender, also called Return-Path, bounce domain, MAIL FROM, or 5321.From, uses a domain you control under the same organizational domain as the visible From address. Then publish the SPF configuration required for that envelope sender domain to authorize the ESP's sending source. Adding an IP to the visible From domain's SPF record does not fix the problem when SPF is being checked against a different envelope domain. Postmaster Tools reports the results; the configuration changes happen at the ESP and in DNS.
The confusing part is that SPF can pass and still fail alignment with the domain you are looking at in Google Postmaster Tools. If the header says SPF passed for bounce.vendor.example, but the visible From is news.example.com, SPF authentication passed for the envelope domain. It did not prove SPF alignment with the visible sending domain. For DMARC, the SPF-authenticated domain must satisfy the alignment mode in the domain's DMARC policy. The default relaxed mode allows the same organizational domain, while strict mode requires an exact domain match. A passing DKIM signature with a matching domain can satisfy DMARC instead.
- Inspect the headers of a real Gmail-delivered message before changing DNS.
- Set a custom bounce or MAIL FROM domain in the ESP, then configure its SPF authorization.
- Do not assume the domain in the visible From address is the domain SPF checked.
- DKIM can satisfy DMARC even when SPF authenticates a different organizational domain.
What SPF alignment requires
SPF uses the envelope sender domain, not the visible From address people see in the inbox. Google reports the results for the selected domain and authentication view. Google's sender guidelines require SPF or DKIM for all senders. Bulk senders, generally those sending about 5,000 or more messages to personal Gmail accounts in 24 hours, must configure both SPF and DKIM, plus DMARC with at least p=none. For direct mail, either the passing SPF domain or a passing DKIM domain must satisfy From-header alignment.
Key rule
If SPF passes for mail.vendor.example while the visible From domain is example.com, SPF passed for mail.vendor.example. Under relaxed DMARC alignment, the envelope sender can use example.com or a subdomain such as bounce.example.com. Under strict alignment, the envelope sender domain must exactly match the visible From domain. In both cases, SPF must pass for DMARC to use it.
SPF pass
- The receiving server checks whether the connecting IP is authorized by the envelope sender domain.
- A vendor envelope domain can pass SPF with no connection to your visible From domain.
- The SPF TXT record is resolved at the envelope sender domain, not every domain in the headers.
SPF alignment
- DMARC compares the SPF-authenticated domain with the visible From domain.
- Relaxed alignment requires the same organizational domain; strict alignment requires an exact domain match.
- A matching domain without an SPF pass is not enough for DMARC.
How to read SPF states
Check authentication and domain matching separately before changing records.
Passing and aligned
DMARC can pass via SPF
The envelope sender passes SPF and satisfies the domain's relaxed or strict DMARC alignment policy.
Passing but separate
Check sending identity
SPF passes for a domain that does not satisfy From-header alignment. DMARC can still pass through DKIM.
Not passing
Inspect the result
Distinguish fail or softfail from none, permerror, and temperror before deciding whether authorization or DNS needs fixing.
No useful data
Check reporting setup
Check domain verification, dashboard selection, reporting delay, and personal Gmail traffic volume.
Choose the right Postmaster Tools authentication view
In the Authentication dashboard, check which view is selected before interpreting a low SPF rate. The views group messages by different domains:
|
|
|---|---|
View by From header domain | Messages grouped by the visible From domain, with SPF, DKIM, and DMARC results. |
View by DKIM and SPF domains | Authentication results for the selected DKIM or SPF domain. This view does not show a DMARC success rate. |
Relaxed DMARC alignment between bounce.example.com and example.com does not make them the same domain for an SPF-domain view. The Compliance status dashboard groups the primary domain with its subdomains; it is not a separate subdomain report.
Google documents these distinctions in its Postmaster Tools dashboard guidance. Use the message headers to verify a configuration change before interpreting the dashboard trend.
What Google checks in headers
Google Postmaster Tools authentication dashboard with SPF, DKIM, and DMARC rates.
Open a received message in Gmail on the web, select the More menu next to Reply, then choose "Show original". Inspect the 5321.From domain, the DKIM signing domain, and the 5322.From domain. The 5321.From value is usually visible in Return-Path or smtp.mailfrom. The 5322.From value is the visible From address the recipient sees. DKIM uses the domain in the d= tag of the DKIM-Signature header. The separate Sender header and Reply-To address do not determine DMARC alignment.
Header fields to inspecttext
Return-Path: <bounce@bounce.example.com> Authentication-Results: mx.google.com; spf=pass smtp.mailfrom=bounce.example.com; dkim=pass header.d=example.com; dmarc=pass header.from=example.com DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector1; ... From: Brand <news@example.com>
|
|
|
|---|---|---|
Return-Path | 5321.From | Records the envelope sender used for delivery. |
Authentication-Results | spf=pass smtp.mailfrom= | Shows the SPF result and the domain Gmail checked. |
DKIM-Signature | d= | Identifies the signing domain; confirm its signature passed in Authentication-Results. |
From | 5322.From | The domain DMARC compares against. |
The domain that matters depends on the authentication check.
A message can say SPF pass and still fail SPF alignment. For example, if Return-Path is bounce@track.example.net and From is news@example.com, SPF authenticates track.example.net. Adding example.com to Postmaster Tools does not change that result. Add and verify a domain you control that is used for SPF or DKIM authentication. Add a sending subdomain separately when you need its authentication dashboard; the Compliance status dashboard still covers the primary domain.
How to make SPF match your domain
The fix is to use a custom envelope sender domain under your own domain. Most ESPs call this a custom Return-Path, custom bounce domain, or custom MAIL FROM domain. A branded sending domain sometimes configures only DKIM or tracking links, so confirm that the setting actually changes the SMTP envelope sender. Its SPF configuration must authorize the platform that sends the mail.
- Choose a dedicated subdomain such as bounce.example.com, and check that it satisfies the applicable relaxed or strict SPF alignment mode.
- Set the platform's MAIL FROM or Return-Path domain to that subdomain.
- Publish the exact SPF TXT record or CNAME delegation the ESP requires, plus any required MX record for bounce handling.
- Send a test to Gmail and confirm that smtp.mailfrom uses your subdomain, SPF passes, and DMARC passes.
- Monitor Google Postmaster Tools and DMARC reports after the change.
Illustrative DNS records, replace provider values before usetext
bounce.example.com. TXT "v=spf1 include:spf.esp.example -all" selector1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=PUBLICKEY" _dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
These records are examples, not values to copy unchanged. Replace spf.esp.example and PUBLICKEY with the ESP's instructions, and use a reporting mailbox you operate. A bounce subdomain does not inherit its parent's SPF record. If it uses a TXT-based setup, publish one SPF record containing all required authorizations at that name.
After publishing the record, validate the SPF syntax and lookup behavior with Suped's SPF checker. A syntax error can produce permerror; an unauthorized source can produce fail or softfail. A correct SPF record on the visible From domain does not resolve a problem on the bounce domain.
Confirm whether the ESP requires TXT and MX records or a CNAME that delegates the bounce domain. Do not put a CNAME alongside a TXT or MX record at the same DNS name. Follow the ESP's exact instructions, wait for cached DNS answers to expire, and verify the final result in Gmail headers.
SPF checker
Find SPF syntax issues, lookup limits, and weak records.
?/16tests passed
A correct result looks straightforward: Gmail shows spf=pass, the smtp.mailfrom domain is your bounce subdomain, and that subdomain satisfies the DMARC alignment mode used by the visible From domain. If the header still shows the ESP's domain, check whether the custom MAIL FROM setting is active or whether the ESP has fallen back to its default domain because verification or bounce routing failed.
Authorize only legitimate sending sources
Only add an IP to SPF when that IP sends mail for the exact envelope sender domain. Adding the connecting IP to example.com does nothing when the checked domain is bounce.vendor.example. Do not authorize unrelated forwarding servers just to improve the displayed SPF rate.
Relaxed and strict SPF alignment
DMARC controls SPF alignment with the aspf tag. If aspf is absent or set to r, relaxed alignment applies. An envelope sender at bounce.example.com satisfies relaxed alignment with a visible From address at news@example.com because both use the organizational domain example.com. With aspf=s, strict alignment applies and smtp.mailfrom must use the exact domain found after the @ in the visible From address. In that case, bounce.example.com does not satisfy alignment with example.com.
Alternative DMARC SPF alignment modes, publish only one recordtext
# Relaxed SPF alignment _dmarc.example.com. TXT "v=DMARC1; p=none; aspf=r" # Strict SPF alignment, an alternative to the record above _dmarc.example.com. TXT "v=DMARC1; p=none; aspf=s"
|
|
|
|
|---|---|---|---|
Relaxed (aspf=r) | example.com | bounce.example.com | Yes |
Strict (aspf=s) | example.com | bounce.example.com | No |
Strict (aspf=s) | news.example.com | news.example.com | Yes |
The same custom bounce domain produces a different result under strict alignment.
Check before choosing strict mode
Before switching to aspf=s, check every legitimate sender that relies on SPF for DMARC. It must use an envelope domain exactly matching its visible From domain. A custom bounce subdomain will not satisfy strict SPF alignment with the root domain, but DMARC can still pass through a valid DKIM signature that satisfies its separate adkim setting.
SPF includes and DNS lookup limits
You do not need to include the sending IP directly in SPF if the ESP gives you a maintained include mechanism that already covers the sending pool. Direct IP mechanisms are valid, but they need updating when the ESP changes infrastructure. Includes reduce that maintenance, as long as SPF evaluation stays within the DNS lookup limit.
SPF permits at most 10 evaluated DNS-querying terms, including nested include and redirect evaluations. The terms include, a, mx, ptr, exists, and redirect count toward that limit; ip4, ip6, and all do not. Exceeding the limit produces permerror. Suped's SPF flattening can reduce lookup pressure, but it does not fix a mismatch between Return-Path and From. Confirm the envelope domain first, then optimize its SPF record.
Provider include
- The ESP can update its sending IPs without asking you to edit DNS.
- Nested includes count toward the same lookup limit, even when your own record has only a few entries.
- Use the provider-supplied include for an ESP-managed shared or changing sending pool.
Direct IPs
- You must update DNS when the sender adds, removes, or rotates IPs.
- Missing an active IP can stop its messages passing SPF.
- Use ip4 or ip6 for dedicated servers or stable sending IPs you control.
|
|
|
|---|---|---|
Add include | Yes | It is on the envelope domain and covers the sending source. |
Add IP | Sometimes | The IP is stable and requires direct authorization. |
Edit From-domain SPF | No | Return-Path uses another domain. |
Set custom MAIL FROM | Yes | Its SPF passes and the domain satisfies the required alignment mode. |
Changing SPF on the wrong domain does not change what Gmail checks.
When DKIM can satisfy DMARC
If the immediate goal is DMARC compliance, a passing DKIM signature with a matching domain is an alternative to SPF alignment. DMARC passes when either SPF or DKIM authenticates successfully and satisfies alignment with the visible From domain. If From is news@example.com and the ESP signs with d=example.com or d=mail.example.com under relaxed DKIM alignment, DMARC can pass even when SPF still uses a vendor bounce domain.
DMARC compares the visible From domain with the SPF and DKIM domains; one passing, matching method is enough.
That distinction matters in Google Postmaster Tools. DKIM can satisfy the DMARC alignment requirement, but bulk senders still need SPF and DKIM authentication. If you specifically want SPF authentication tied to your domain in the SPF-domain view, configure the envelope sender domain too.
Forwarding can cause SPF to fail because the forwarding server's IP is not authorized by the original envelope domain. A forwarder that rewrites MAIL FROM can pass SPF for its own domain while failing alignment with your From domain. DKIM can preserve DMARC success if a matching signature remains valid and the signed content is not changed.
When the mail stream uses subdomains, the setup can look correct on the root domain while the actual sending subdomain is wrong. Tracking-link domains do not determine SPF or DKIM alignment. For related edge cases, the sending subdomain guide and the Postmaster Tools troubleshooting guide cover common troubleshooting branches.
Authentication and alignment must both pass
SPF passing with the required domain match is sufficient for DMARC to pass through SPF. Merely changing Return-Path to a matching domain is insufficient if SPF still fails. The same rule applies to DKIM: the signature must pass and its d= domain must satisfy the applicable alignment mode.
How Suped fits into the workflow
For a one-off check, Gmail headers and DNS lookups are enough. Suped, our DMARC reporting and email authentication platform, adds ongoing source-level monitoring. Use aggregate DMARC reports in Suped to compare raw SPF authentication with the SPF alignment result and identify legitimate senders that still need configuration changes.
Review the envelope domain and DKIM signing domain for each source, then retest messages after fixing the ESP or DNS configuration. Suped's Hosted SPF helps manage SPF authorizations when DNS lookup limits become a recurring problem. It does not change the MAIL FROM identity used by your ESP.
SPF flattening drawer showing an over-limit record, sender editing, lookup counts, and the hosted record setup
For a DNS review before making changes, run Suped's domain health checker against the envelope domain and the visible From domain. Use received-message headers to verify the actual DKIM selector and authentication results. Review blocklist (blacklist) findings separately; they do not determine SPF alignment.
A practical monitoring setup
- Use a custom bounce domain and keep its SPF configuration valid.
- Ask the ESP to sign DKIM with a domain that satisfies From-header alignment.
- Review DMARC reports in Suped after changing an ESP or authentication settings.
- Compare direct-delivery tests with forwarded samples before changing SPF authorizations.
A practical troubleshooting sequence
Use this sequence when Google Postmaster Tools shows SPF problems or missing data for a domain that should be sending authenticated mail. It avoids DNS changes until the headers prove which domain Gmail is checking.
- Confirm that your own SPF or DKIM authentication domain is added and verified in Google Postmaster Tools, and check which authentication view you selected.
- Read a received message's headers and find smtp.mailfrom, Return-Path, DKIM d=, and the visible From domain.
- Compare the SPF domain with the From domain under the applicable relaxed or strict alignment mode, and check the SPF result itself.
- If needed, configure the ESP's custom MAIL FROM or Return-Path domain before editing unrelated SPF records.
- Resolve the SPF configuration at the envelope domain. Check for multiple SPF records, syntax errors, nested lookup limits, and any provider-required bounce-routing records.
- Send a fresh message to Gmail from each affected sending source, inspect its authentication results, then monitor Postmaster Tools and DMARC reports.
Request to send to your ESPtext
Please configure our MAIL FROM or Return-Path domain as: bounce.example.com Please provide the exact SPF TXT record or CNAME delegation required. Please include any required MX record and explain default-domain fallback behavior. Please also enable DKIM signing with d=example.com or a subdomain that satisfies our DMARC alignment settings.
Once the ESP confirms the change, do not judge the fix from the DNS record alone. The final proof is in the message that Gmail receives. If smtp.mailfrom still shows the vendor domain, check whether the custom envelope sender is active and whether DNS verification or bounce routing triggered fallback. If smtp.mailfrom shows your bounce subdomain and SPF passes, the SPF authentication side is set correctly. Confirm relaxed or strict alignment separately. Passing authentication does not guarantee inbox placement; sender reputation and spam complaints still affect delivery.
Frequently asked questions
Only include the IP when it sends mail for the exact envelope sender domain and the ESP tells you to authorize it directly. Most ESP setups use an include mechanism or provider-managed DNS delegation instead.
SPF can pass for the ESP's envelope domain while failing alignment with your visible From domain. Check the selected authentication view and domain. Missing data can also result from low personal Gmail volume or reporting delays; it does not prove SPF failed.
A passing DKIM signature can satisfy DMARC when its d= domain meets alignment with the visible From domain. It does not change SPF alignment or remove Gmail's SPF authentication requirement for bulk senders.
Add and verify a domain you control that authenticates outgoing email through DKIM d= or SPF Return-Path. Add an authentication subdomain separately for its own dashboard. Select the appropriate From-header or SPF/DKIM-domain view; Compliance status still groups the primary domain with its subdomains.
Verify a fresh message immediately. Dashboard data typically updates within 24 hours, sometimes longer. Compliance uses a rolling average, so Google recommends checking again after seven days. Low personal Gmail volume can leave data unavailable.
