ZeroHook
Back to blog
DMARC

Gmail Unverified Sender? Check DMARC

Gmail's unverified sender banner means authentication failed or DMARC is missing. Fix SPF, DKIM, and alignment before recipients stop trusting your mail.

ZeroHook
ZeroHook Team
Security Analysts
Jun 23, 2026~3 min read
Gmail Unverified Sender? Check DMARC
Your customer forwards a screenshot. Gmail shows a grey question mark next to your company name. "Unverified sender." Your campaign stats say delivered. A 19-person ecommerce brand in Lisbon saw this on post-purchase emails in January 2026. Klaviyo reported 98% delivery. Gmail's UI told recipients the sender might not be who they claim. Open rates dropped 22% in two weeks. SPF existed. DKIM was off. DMARC was never published. The From: address was correct. Authentication was not. Google's bulk sender guidelines (February 2024, still enforced 2026) require SPF, DKIM, and DMARC for senders above 5,000 messages per day to Gmail. Smaller senders see the same warning when authentication fails or DMARC is absent. The gmail unverified sender dmarc connection is direct: receivers cannot verify your domain, so Gmail warns the user instead of silently trusting the message. This is softer than a hard bounce. It is worse for revenue. People do not click mail they think might be fake.

What Gmail's Unverified Sender Warning Means

Not the same as spam folder

Unverified sender is an inbox warning banner. The message may still arrive in Primary or Promotions. Recipients see that your domain lacks strong authentication signals Gmail recognizes.

Not the same as 550 5.7.26

Hard SMTP rejection blocks delivery entirely. Unverified sender means Gmail accepted the message but will not vouch for the sender identity. Both trace back to authentication gaps.

What Gmail checks

SPF pass on the envelope path, DKIM signature with valid key, DMARC pass (alignment of SPF or DKIM with the visible From: domain). Missing any leg can trigger the warning depending on policy and reputation context.

Quick fix page: zerohook.org/fix/gmail-unverified-sender

Fix Unverified Sender (Step by Step)

1

Publish DMARC if missing. At Cloudflare or your DNS host, add TXT on _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r

p=none is fine while fixing senders. No DMARC record at all is not fine in 2026.

2

Enable DKIM on every sending path. Microsoft 365: Admin center → Domains → DKIM → create CNAME records for selector1 and selector2, wait for DNS propagation, toggle signing on. Google Workspace: Admin → Gmail → Authenticate email → Generate record → publish at google._domainkey.

3

Fix ESP relay mail. In Mailchimp, HubSpot, Klaviyo, or SendGrid: complete domain authentication (DKIM CNAMEs + custom MAIL FROM if offered). Verify Authentication-Results on a test to Gmail shows dkim=pass with d=yourdomain.com and ideally dmarc=pass.

4

Audit SPF includes so your root record authorizes M365 or Google plus each ESP:

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -all

Stay under 10 DNS lookups. PermError breaks SPF and DMARC together.

5

Send a test to a Gmail account you control. Open → Show original → confirm spf=pass or dkim=pass plus dmarc=pass. Re-send the customer-facing template only after headers are clean.

Frequently Asked Questions

Key takeaways

1

Unverified sender means Gmail cannot verify your domain identity on that message.

2

Publish DMARC, enable DKIM on all paths, fix ESP domain authentication before blaming list quality.

3

Test with Authentication-Results headers, not dashboard green checkmarks alone.

4

The warning hurts trust and clicks even when mail is "delivered."

Validate your DMARC record and policy at zerohook.org/dmarc-checker before your next campaign lands with a question mark next to your brand name.

Share this analysis

Help others discover this content

Fix DNS before the next audit
Provider-specific copy-paste fixes for Cloudflare, Route53, GoDaddy, and more.
Start free scan

More from our blog

DMARC Alignment Failed, SPF Passed
DMARC

DMARC Alignment Failed, SPF Passed

When DMARC alignment fails but SPF passes, your envelope-from or DKIM domain does not match the visible sender. Quick diagnosis from Authentication-Results and ESP fix steps.

DMARC Policy: None vs Quarantine vs Reject
DMARC

DMARC Policy: None vs Quarantine vs Reject

Choosing a DMARC policy is not a one-time DNS edit. None monitors, quarantine filters, reject blocks unauthenticated mail. Rollout order, pct= staging, and provider-specific pitfalls for 2026.

Roll Out DMARC p=reject in 8 Weeks
DMARC

Roll Out DMARC p=reject in 8 Weeks

Move from monitor-only DMARC to p=reject in eight weeks using aggregate reports, pct= staging, and sender inventory. Standard path for SMBs on M365, Google Workspace, and ESP relay mail.