Gmail accounts have begun rejecting Emails without DMARC
Gmail accounts have begun rejecting emails from hosts that do not have a DMARC authentication mechanism. It may just be the beginning, as other mail servers may follow suit. DMARC (Domain-based Message Authentication Reporting & Conformance) shows that that mail server is allowed to send emails on behalf of the domain. There are two types of mechanisms, SPF and DKIM. On IONOS shared accounts only SPF is supported which is sufficient.
In this post we will walkthrough how to fix this on IONOS hosting site, but the general idea can be used at any hosting provider.
What does a rejected email look like?
Below is a sample email you can expect to receive from google explaining why your email was rejected. In this case we don't have DMARC set up with an SPF or DKIM record on our domain.
FROM: Mail Delivery System firstname.lastname@example.org
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of
its recipients. This is a permanent error.
The following address failed:
SMTP error from remote server for TEXT command, host: gmail-smtp-in.l.google.com (188.8.131.52) reason: 550-5.7.26 This message does not pass authentication checks (SPF and DKIM
550-5.7.26 do not pass). SPF check for [wassam.com] does not pass w
550-5.7.26 ip: [184.108.40.206].To best protect our users from spam, the mes
550-5.7.26 has been blocked. Please visit
550-5.7.26 https://support.google.com/mail/answer/81126#authentication fo
550 5.7.26 information. m2-20020a056870194200b001726951d683si12281173oak.3
13 - gsmtp
How to fix it on IONOS
- Login and go to https://my.ionos.com/domains
- Select the Domain you are sending emails under
- Select DNS
- Add Record and select IONOS SPF (TXT)
5 . Select Save
This will use the default server.
6 . For good measure you can change this and add other IONOS mail servers
v=spf1 include:_spf.perfora.net include:_spf-us.ionos.com include:_spf.kundenserver.de ~all
If you are adding a custom mail server and not IONOS, change the include: <mailer domain> with the mail server you allow to send messages.
7 . Now add a DMARC record by select TXT
8 . Set the values as follows:
value: v=DMARC1; p=reject; rua=mailto:email@example.com; ruf=mailto:firstname.lastname@example.org; fo=1:s;
Change the email address to appropriate account you need.
Here is some information on what these settings mean:
v= DMARC version
p= policy to use
rua= Where to send the DMARC aggregate reports
ruf= Where to send the DMARC failure reports
For more details on how DMARC works and other parameters available, visit the following site.
What does a DMARC Report Email Report Look like?
<?xml version="1.0" encoding="UTF-8" ?>
What does the report tell us?
- Source IP is the IONOS mail server
- DKIM test fails
- SPF test passes
- Google even provides helpful information on how to address the issue
DKIM Failing is not an issue. You can only install a DKIM private key on a server hosted account with IONOS. The SPF is allowed for shared IONOS servers, and is sufficient to prevent email blocking.
Although IONOS shared server accounts do not support DKIM, these instructions walk you through adding an SPF record. A similar solution can be used at other hosting providers outside of IONOS.