Fix Gmail’s Authentication-Failure Warning - Online Help | Zoho Campaigns

When Gmail warns of authentication failure

An authenticated domain shows mailbox providers that your emails are genuine and not spam. If Gmail warns that it can’t verify your domain, it means your mail failed authentication — usually a missing or broken SPF/DKIM record, a DMARC alignment failure, or sending from a public domain — and the fix is to authenticate your sending domain properly. This isn’t optional anymore: under Google and Yahoo’s bulk sender requirements (in force since February 2024), senders must pass SPF, DKIM, and DMARC, and since late 2025 Gmail rejects unauthenticated bulk mail outright (error 550 5.7.26) instead of merely marking it as spam. If the email sender domain is not properly authenticated, Gmail classifies it as spam and displays warnings like the following:

Info
“Why is this message in Spam? It has a from address in zylker.com but has failed zylker.com’s required tests for authentication.”

Info
“Be careful with this message. Our systems couldn’t verify that this message was really sent by zylker.com. You might want to avoid clicking links or replying with personal information.”

Gmail has indicated that it couldn’t verify whether your domain is authenticated. If your recipients have received either of the above messages, you need to authenticate your domain properly.

Why there's authentication failure in Gmail – An infographic.

What could be the reason

  1. Sender domain not authenticated (missing or broken SPF or DKIM).
  2. A DMARC alignment failure — SPF or DKIM passes, but the authenticated domain doesn’t match the domain in your From address, so DMARC fails.
  3. Public domain sender address (a From address at gmail.com, yahoo.com, and so on).
  4. More than one SPF record configured for the same domain.

More than one SPF record

You may have several SPF TXT records configured for your domain. A domain must have exactly one SPF record — per RFC 7208, two or more “v=spf1” records cause a PermError, which fails SPF for every message you send, even from an authorized server. When you send through Zoho Campaigns, mailbox providers look up your SPF record in DNS and check whether it matches our sending source. The fix is not to keep multiple records — it’s to merge them into a single SPF record that includes Zoho Campaigns along with all your other sending sources, keeping the total under the 10 DNS-lookup limit.

How to resolve

  1. Only use your business domain for authentication and sending. Avoid using public domains (such as Gmail, Yahoo!, and AOL — note AOL now runs on Yahoo’s infrastructure) in your From address. Because Gmail and Yahoo publish strict DMARC policies on their own domains, mail sent from a gmail.com or yahoo.com From address through a third party is guaranteed to fail DMARC. (To learn why sending from public-domain sender addresses lands in spam, see the related article — update this link to your current KB page.)

  2. Check that your domain is properly authenticated with Zoho Campaigns.

  3. Set up DMARC in addition to SPF and DKIM. Gmail no longer merely recommends DMARC — it is required for bulk senders. Start with a policy of p=none to monitor, then move toward p=quarantine or p=reject once your legitimate mail passes. Make sure SPF or DKIM aligns with your From domain, since alignment is what DMARC actually checks.
A perfectly authenticated domain makes your emails land in inboxes and prevents these warnings from Gmail.