Gmail shows the question mark when it cannot authenticate a message with SPF or DKIM. Make sure every system that sends as your domain passes at least one, ideally both, and test each with a Gmail address.

What Gmail changed yesterday

On Tuesday Gmail began marking two things it had previously kept to itself.

When it cannot confirm that a message really came from the domain in the sender's address, it now shows a question mark where the sender's picture or logo would normally appear.

And when a message arrives at Gmail without having been encrypted on the way, a small red open padlock now appears with it.

Neither changes where a message is delivered. But a customer who sees a question mark beside your newsletter has been told, quietly, that Gmail is not sure it came from you.

What the checks actually prove

The fourth is why the first two exist. Email was designed with no proof of who sent it.

SPF and DKIM are how a receiving service such as Gmail checks that a message claiming to come from your domain was sent with your permission.

Both live in DNS, the records that tell the internet where your domain's website and email are.

Why mail from your website fails

Many small business websites send email themselves: contact form notices, order confirmations, booking reminders, sometimes the newsletter.

They send it from the web server, with your business address as the sender. But the web server is rarely in your SPF record, which usually lists only your office email provider, and it almost never signs with DKIM.

So Gmail receives a message claiming to be from your domain, from a server your domain never authorised, with no signature. That is exactly the case the question mark was made for.

Why a mailing service can fail too

A mailing service sends from its own servers on your behalf. Most can authenticate your mail as yours, but only after you add the records they supply to your domain.

Until then, Gmail can tie the message only to the service, and shows the service's domain beside your name with the word via.

A small or older service may not sign the mail at all, and then the question mark appears.

Either way, the settings in your mailing account usually include a section on authentication or verified domains. If nobody has completed it, that is the first job.

Checking your own mail

The test takes a few minutes. Send a newsletter, a form notice and an ordinary office email to a Gmail address you can open.

Open each one. If a question mark sits where the sender's picture should be, that message failed.

Then click the small arrow under the sender's name. Mailed-by and signed-by show which domains passed SPF and DKIM, and if your domain appears under neither, Gmail could not connect the message to you.

For more detail, Show original displays the raw headers, including lines that read spf=pass or dkim=pass, or fail.

A worked example

An indoor batting cage and baseball training centre sends its members a Thursday email all winter: open cage times, the weekend's clinics and any change to the hours. Its website also sends a confirmation for every cage booked online.

Both went out from the web server through plugins, with the centre's own address as the sender. The centre's everyday mail ran on Google Apps for Work, and its SPF record listed only Google's servers.

When the change was announced, the owner made a test booking from a Gmail address. The confirmation arrived with a question mark where the centre's initial would be, and the centre's domain appeared under neither mailed-by nor signed-by.

The fix took an afternoon. The Thursday email moved to a mailing service, set up with the centre's domain by adding the records the service supplied.

The website's confirmations now go out through the centre's Google Apps account, signed in with a username and password, rather than straight from the server. DKIM was switched on in Google Apps at the same time.

A second round of tests showed the centre's domain under signed-by on every message, and no question mark.

Fixing the records

The fix is a short list of DNS changes, made by whoever manages your domain.

First, list every service that sends mail as your domain: the office email provider, the website, the mailing service, any booking or invoicing system. Each needs to pass SPF or DKIM, or to send through something that does.

Your domain can have only one SPF record. A second one added beside the first, a common mistake, breaks both, so new services are added to the existing record.

Then turn on DKIM wherever it is offered. Google Apps for Work and Office 365 both offer it, as do most mailing services; each gives you a record to publish, and signing starts once it is in place.

The red padlock

The padlock is about how the message travelled, not who sent it. It means the server that handed the message to Gmail did not encrypt the connection.

Large email providers and mailing services encrypt as a matter of course. The usual culprits are older web servers, small hosting accounts and office mail servers nobody has updated in years.

The fix is on the server rather than in DNS, so it is a question for your host: whether the server sending your mail uses TLS, and if not, whether it can.

Gmail also shows the padlock when you write to someone whose mail service does not support encryption. That one is on their side.

The counter-case

The question mark is a signal, not a block, and many recipients will never notice it.

If your office email provider was set up properly, everyday office mail is usually fine already, and a business that emails a few customers by hand may have nothing to fix.

The risk is concentrated in the mail nobody thinks about: the website, the newsletter, the booking system.

Test those three this week, and fix the records for whichever fail.

Before the next newsletter

  1. Send test messages from every system to Gmail.
  2. Look for the question mark beside the sender.
  3. Check mailed-by and signed-by under the arrow.
  4. List every service that sends as your domain.
  5. Keep one SPF record covering them all.
  6. Turn on DKIM wherever it is offered.
  7. Ask your host about TLS on outgoing mail.

Step four is the one most businesses get wrong, because the website and the booking system are forgotten. The office email gets set up properly, while the confirmations customers see first were never checked.

Making sure the people on the list still want the newsletter is a separate question, covered in customers whose implied consent runs out this year.

Frequently asked questions

What does Gmail's question mark mean?

That Gmail could not authenticate the message with SPF or DKIM, so it cannot confirm the message really came from the domain in the sender's address.

Does the question mark stop delivery?

No. It is a visible signal rather than a block, but it tells the recipient that Gmail is unsure the message came from you, which undermines trust in it.

Why do emails from my website fail?

The web server sends with your address but is rarely listed in your SPF record and almost never signs with DKIM, so Gmail cannot connect the message to your domain.

Can I add a second SPF record?

No. A domain can have only one, and a second record breaks both. Add new sending services to the existing record instead.

What does the red open padlock mean?

The server that handed the message to Gmail did not encrypt the connection. The fix is on the sending server, so ask your host whether it uses TLS.

How do I test my own email?

Send messages from every system to a Gmail address, look for the question mark, then check mailed-by and signed-by under the arrow beside the sender's name.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Newsletter showing a question mark in Gmail?

Send us a test message. We will tell you which records are missing and fix them.

Start a Conversation