3 ms·

This doesn't seem to have hit any major tech news outlets at the time, but since I've stumbled upon it twice in a short timeframe, I can only assume that others

This doesn't seem to have hit any major tech news outlets at the time, but since I've stumbled upon it twice in a short timeframe, I can only assume that others have been bitten by it: "Starting November 2022, new senders who send email to personal Gmail accounts must set up either SPF or DKIM. Google performs random checks on new sender messages to personal Gmail accounts to verify they’re authenticated." There is no explanation on how the randomness in this works, but I can't imagine it would be helpful in troubleshooting related issues.

LeonM 3y ago
There is no randomness, this is how DMARC works. You need SPF or DKIM alignment (either one will do). Basically what is happening, is that Gmail is slowly enforcing DMARC for new domains. This is a good thing, any domain that sends email should use DMARC, and all email should be properly signed with a DKIM signature. Adopting DMARC can be difficult for existing domains, but if implemented from day one (what Google is mandating here for 'new' domains) it is fairly trivial. That all said: if one is setting up email for any domain, you should focus on DKIM, rather than SPF. SPF is horribly flawed in many ways, and can break in many ways. If you ensure that all your email is DKIM signed (and aligned), you'll have covered 99% of deliverabilty. You should still enable SPF though to support the 1% of legacy email services that don't support DKIM, but just don't rely on SPF alone.
- alturiak 3y ago
  Thanks for the elaboration that certainly adds useful context. While I personally am aware of DMARC and haven't been hit by this, I've heard from friends that small businesses aren't able to contact them on their gmail-address anymore due to them (the businesses) not having setup neither SPF nor DKIM. I fully agree that this shouldn't be the case anymore in this day and age, yet here we are. The "random"-bit is directly mentioned in Google's support article and I can't figure out what it means. Either they enforce it for a sender's domain or they don't. My best guess is that they randomly decide when to start enforcing it for new or (probably more likely at this point) previously known individual domains.
jseliger 3y ago
I got hit by this with seliger.com domain emails, although seliger.com predates gmail.

LeonM 3y ago

There is no randomness, this is how DMARC works. You need SPF or DKIM alignment (either one will do). Basically what is happening, is that Gmail is slowly enforcing DMARC for new domains. This is a good thing, any domain that sends email should use DMARC, and all email should be properly signed with a DKIM signature. Adopting DMARC can be difficult for existing domains, but if implemented from day one (what Google is mandating here for 'new' domains) it is fairly trivial. That all said: if one is setting up email for any domain, you should focus on DKIM, rather than SPF. SPF is horribly flawed in many ways, and can break in many ways. If you ensure that all your email is DKIM signed (and aligned), you'll have covered 99% of deliverabilty. You should still enable SPF though to support the 1% of legacy email services that don't support DKIM, but just don't rely on SPF alone.

alturiak 3y ago
Thanks for the elaboration that certainly adds useful context. While I personally am aware of DMARC and haven't been hit by this, I've heard from friends that small businesses aren't able to contact them on their gmail-address anymore due to them (the businesses) not having setup neither SPF nor DKIM. I fully agree that this shouldn't be the case anymore in this day and age, yet here we are. The "random"-bit is directly mentioned in Google's support article and I can't figure out what it means. Either they enforce it for a sender's domain or they don't. My best guess is that they randomly decide when to start enforcing it for new or (probably more likely at this point) previously known individual domains.

jseliger 3y ago

I got hit by this with seliger.com domain emails, although seliger.com predates gmail.