Microsoft has enforced stricter inbound email authentication checks starting around November 5–6, 2026, causing even some legitimate senders and business domains to be rejected if their DNS or email authentication settings are missing or misconfigured. More information is available about this here.
To fix this when you are using Google Workspace for your email, you will need to do the following:
Enable DKIM (DomainKeys Identified Mail)
DKIM adds a digital cryptographic signature to the header of every email you send. This proves to Microsoft that the email actually came from your domain and wasn't altered in transit.
-
Log into your Google Admin Console (
://google.com). - Go to Apps > Google Workspace > Gmail > Authenticate email.
- Click Generate New Record (choose 2048-bit if your DNS provider supports it).
-
Copy the host name (usually
google._domainkey) and the long text string generated. - Send these values to GuestTraction and we will Create a new TXT record in your domain's DNS manager with those values.
- Once we have told you we have updated this record, please return to the Google Admin Console and click Start Authentication.
Note, we will also add a DMARC Record for you at the same time/
DMARC ties your SPF and DKIM together. It tells Microsoft exactly what to do with an email that fails authentication (e.g., monitor it, quarantine it, or reject it). Even a basic "monitoring" policy drastically improves deliverability.
- Type: TXT
-
Host/Name:
_dmarc -
Value:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
0 Comments