Most common causes: (1) DKIM not enabled in Admin console — Gmail sends without DKIM signature, so DMARC alignment fails. Fix: enable DKIM under Apps → Google Workspace → Gmail → Authenticate email. (2) SPF record missing include:_spf.google.com — mail sent from Google Workspace fails SPF check. (3) A forwarder in the middle broke the DKIM signature but ARC isn’t preserving the original verdict. (4) A relay is rewriting headers. Check your DMARC aggregate reports (RUA data) — they’ll show which specific sending IP is failing and why. Debug with the email authentication checker.
All questions
Why does my Google Workspace email fail DMARC?
Read the full guide
What Is DMARC?
DMARC is the enforcement layer of email authentication. SPF and DKIM do the checking — DMARC tells receiving servers what to do when they fail, and reports back to you who's sending email using your domain.