C55/100

gmail.com

Name: gmail.com email authentication report
Creator: MailAuthWatch
License: https://creativecommons.org/publicdomain/zero/1.0/

2 fixes stand between this domain and a clean A. 2 items below, ordered by how much inbox they are costing you. Measured 0s ago from public DNS in 76 ms.

SPF PASSDKIM NOT FOUNDDMARC NOT ENFORCINGMX OK

Monitor this domain Re-run check

Fix these, in this order, or hand the list to your agent

ranked by impact

No DKIM key found under 79 common selectors.

Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.

Do this: in Google Admin go to Apps → Google Workspace → Gmail → Authenticate email, generate a 2048-bit key with selector "google", publish the TXT record, then click Start authentication.

DMARC is sitting at p=none.

You are collecting reports and enforcing nothing, so anyone can still send as you. Gmail and Yahoo accept p=none from bulk senders, but it protects nobody.

Do this: move to p=quarantine; pct=25 for two weeks, watch the reports, then step to pct=100 and p=reject.

Records found

SPF · TXT

v=spf1 redirect=_spf.google.com

DMARC · _dmarc.gmail.com

v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com

DKIM · 0 of 79 selectors

none under common selectors

MX · Google Workspace

5 gmail-smtp-in.l.google.com
10 alt1.gmail-smtp-in.l.google.com
20 alt2.gmail-smtp-in.l.google.com
30 alt3.gmail-smtp-in.l.google.com
40 alt4.gmail-smtp-in.l.google.com

Fix this with your AI agent

AGENT-READY

A prompt built only from what was measured: the records as published, 2 tasks in order, exact record values and Google Cloud DNS commands, guardrails, and how to verify. Paste it into Claude, Cursor, Copilot or ChatGPT.

# Fix email authentication for gmail.com

You are working on the DNS and mail configuration for gmail.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade C (55/100).
Report: https://www.mailauthwatch.com/check/gmail.com

## What is published right now (do not assume anything else)
- SPF (TXT gmail.com): v=spf1 redirect=_spf.google.com   — valid, 1 of 10 lookups
- DMARC (TXT _dmarc.gmail.com): v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com
- DKIM: no key found under 79 common selectors
- MX: gmail-smtp-in.l.google.com, alt1.gmail-smtp-in.l.google.com, alt2.gmail-smtp-in.l.google.com, alt3.gmail-smtp-in.l.google.com, alt4.gmail-smtp-in.l.google.com  → Google Workspace
- Nameservers: ns2.google.com, ns4.google.com …  → records are managed in Google Cloud DNS

## Tasks, in order of impact
…

# Fix email authentication for gmail.com

You are working on the DNS and mail configuration for gmail.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade C (55/100).
Report: https://www.mailauthwatch.com/check/gmail.com

## What is published right now (do not assume anything else)
- SPF (TXT gmail.com): v=spf1 redirect=_spf.google.com   — valid, 1 of 10 lookups
- DMARC (TXT _dmarc.gmail.com): v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com
- DKIM: no key found under 79 common selectors
- MX: gmail-smtp-in.l.google.com, alt1.gmail-smtp-in.l.google.com, alt2.gmail-smtp-in.l.google.com, alt3.gmail-smtp-in.l.google.com, alt4.gmail-smtp-in.l.google.com  → Google Workspace
- Nameservers: ns2.google.com, ns4.google.com …  → records are managed in Google Cloud DNS

## Tasks, in order of impact
### 1. No DKIM key found under 79 common selectors.
Why: Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.
Add TXT record:
  google._domainkey.gmail.com  TXT  <value from Google Admin>   (value comes from the provider step below)
Google Admin → Apps → Google Workspace → Gmail → Authenticate email → select the domain → Generate new record (2048-bit, selector "google").
Publish the TXT record it shows, then click "Start authentication".
Where: Cloud DNS → the zone → Add standard.

### 2. DMARC is sitting at p=none.
Why: You are collecting reports and enforcing nothing, so anyone can still send as you. Gmail and Yahoo accept p=none from bulk senders, but it protects nobody.
Replace TXT record:
  _dmarc.gmail.com  TXT  v=DMARC1; p=quarantine; pct=25; sp=quarantine; rua=mailto:mailauth-reports@google.com
Only after DKIM is verified working (see the DKIM task if present). Hold for 14 days, review reports, then pct=100, then p=reject.
Google Cloud DNS CLI/API (adjust identifiers):
  gcloud dns record-sets create _dmarc.gmail.com. --zone=$ZONE --type=TXT --ttl=3600 --rrdatas="\"v=DMARC1; p=quarantine; pct=25; sp=quarantine; rua=mailto:mailauth-reports@google.com\""

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Google Cloud DNS or Google Workspace, stop and say exactly what access you need.

## Verify
  dig +short TXT google._domainkey.gmail.com
  dig +short TXT _dmarc.gmail.com
  dig +short TXT gmail.com
Then open https://www.mailauthwatch.com/check/gmail.com?fresh=1 and confirm:
  DKIM found; DMARC p=quarantine. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.

Open in Claude Open in ChatGPT fix.md

Your agent, your DNS, your review. MailAuthWatch never changes records; it writes the plan and re-checks the result.

Grade history

Free checks keep nothing. Monitoring records every daily measurement and alerts you on change.

History goes back as far as your subscription.

SPF OK

v=spf1 redirect=_spf.google.com

DNS lookups: 1 of 10 allowed
Final mechanism: ~all

OK No problems detected.

Include tree

1 / 10

gmail.com0

└─ include:_spf.google.com+1

DKIM Not found

DKIM selectors cannot be listed from DNS, so 79 selectors used by common providers were probed. "Not found" means none of those selectors exist; the domain may still sign with a custom selector.

WarningNo DKIM key found under 79 common selectors. If you know your selector, add it to the check; if you have no DKIM at all, enable it at your mail provider.

DMARC OK

v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com

Policy: p=none · subdomains sp=quarantine
Applies to: 100% of failing mail
Aggregate reports: mailto:mailauth-reports@google.com

WarningPolicy is p=none: you receive reports but spoofed mail is still delivered. Move to p=quarantine, then p=reject, once reports show legitimate mail passing.

Mail exchange and extras

OK No problems detected.

MTA-STS: OK v=STSv1; id=20190429T010101;
TLS-RPT: OK v=TLSRPTv1;rua=mailto:sts-reports@google.com
BIMI: Not published optional: brand logo in inboxes, requires p=quarantine or reject

How the grade is calculated

Score 55/100. SPF present and valid. SPF ends with ~all. DMARC present and valid. DMARC policy is none (monitoring only). DMARC aggregate reporting enabled. SPF contributes up to 35 points, DKIM up to 25, DMARC up to 40 (policy strength and reporting). Any critical issue caps the grade at C. Lookups that failed are shown as "not measured" and never counted as missing.

Check another domain:

Other recently graded domains

Public checks from the last few days. Every report is re-measured from DNS when opened.

live

DomainSPFDKIMDMARCGrade

spotify.com6 lookups2048-bitp=rejectA salesforce.com4 lookups2048-bitp=rejectA gandi.net2 lookupsnot foundp=noneC zoom.us6 lookups2048-bitp=rejectA skype.com2 lookupsnot foundp=rejectB shopify.com4 lookups2048-bitp=rejectA bing.com1 lookupsnot foundp=rejectB ebay.com10 lookups2048-bitp=rejectA facebook.com1 lookupsnot foundp=rejectB msn.com7 lookups2048-bitp=noneB notion.so0 lookupsnot foundp=quarantineC vercel.com10 lookups2048-bitp=quarantineA