Gmail flags emails as possible spoofing

If Gmail shows a possible spoofing warning, it can't be put down to SPF alone. Open Show original in Gmail and keep Authentication-Results, Received and Return-Path to identify which check failed and which server actually sent the message:

• Be careful with this message. Gmail could not verify that it actually came from dominio.com. Avoid clicking links, downloading attachments or replying with personal information.

SPF authorises servers for the domain used in MAIL FROM or HELO; it doesn't directly validate the visible sender in From. DKIM verifies the message's signature, and DMARC requires SPF or DKIM to be aligned with the visible domain. Review all three results before changing DNS.

The SPF record can be edited from cPanel, but it should only authorise infrastructure that legitimately sends for the domain.

If Gmail is set up with Send mail as through Hostsuar's SMTP server, the message leaves through that external server, and adding _spf.google.com doesn't fix that path. Keep Hostsuar's SPF and DKIM and check their alignment.

Include _spf.google.com only when the domain really sends through Google Workspace or other Google infrastructure, and set up Google's DKIM signing too. After each change, send another sample and confirm in Show original that SPF, DKIM and DMARC give the expected result.

If there are forwards or intermediaries

A forward can make SPF fail because it changes the server delivering the message. DKIM may still be valid if the signed content isn't modified; some intermediaries, lists or added footers alter it. Analyse the full route before authorising a new IP.

Edit the records at the authoritative DNS provider and keep a single SPF policy for each name: don't add a second v=spf1 record. A correct authentication result doesn't prove the content is legitimate either. If the message is unexpected, confirm where it came from through another channel before opening links or handing over information.