Gmail Now Enforces DMARC and SPF Alignment

Gmail now strictly enforces alignment with DMARC and SPF. In simple terms, you can no longer send an email that appears to be from [email protected] unless it is sent through Gmail's own servers. If your contact forms or scripts use the visitor's Gmail address in the "From" line, Gmail will reject these emails because your hosting server is not authorized to send mail on behalf of Google.

Impact on Your Workflow

If your website uses forms (e.g., WordPress, Contact Form 7) that send emails with the visitor's Gmail address as the sender, those emails will fail to deliver.

How to Fix It

To ensure your emails are delivered successfully, follow these best practices when configuring scripts and website forms:

1. Use Your Domain in the "From" Address
   Configure your website or script to send emails from an address belonging to your domain.

   • Incorrect: From: [email protected]
   • Correct: From: [email protected] or [email protected]

2. Set the Visitor's Email in the "Reply-To" Header
   This allows you to reply directly to the visitor without violating Gmail's security rules.
   Example:

   • Reply-To: [email protected]

Why This Matters

These updates are designed to make email safer for everyone by stopping spoofing and phishing attacks. We know changing your usual workflow can feel like a hassle, but these steps help keep the entire email ecosystem secure.

Summary

Google has tightened its email security rules. Gmail will now block any email that looks like it's coming from a Gmail address unless it's actually sent through Gmail's own servers. This mainly affects websites or scripts that use a visitor's Gmail address in the 'From' field."