Skip to main content

What is gappssmtp.com?

gappssmtp.com is the domain Google uses to sign your Google Workspace email when your own domain has no DKIM key. It is why recipients see "via yourdomain.gappssmtp.com". Enter your domain to check.

Where you see gappssmtp.com

Usually in one of two places:

  • Next to the sender name in Gmail: Alice <alice@example.com> via example-com.20230601.gappssmtp.com
  • In the message headers, in the DKIM signature: DKIM-Signature: v=1; a=rsa-sha256; d=example-com.20230601.gappssmtp.com; s=20230601; ...

Both mean the same thing: the message really was sent through Google Workspace, but Google signed it with its fallback key instead of a key for example.com.

Why it happens

DKIM lets a receiver check that a message came from the domain it claims. Google Workspace does not publish a DKIM key for your domain until an admin generates one. Until then, Gmail still signs every message, using a key under gappssmtp.com that Google controls. The signature is valid, but it is for the wrong domain.

Why you should fix it

  • DMARC alignment. DMARC passes only if SPF or DKIM matches your From domain. A gappssmtp.com signature never matches, so a forwarded message that breaks SPF fails DMARC.
  • Bulk sender rules. Since 2024 Gmail and Yahoo require senders of more than 5,000 messages a day to sign with their own domain and publish DMARC.
  • Trust. "via gappssmtp.com" looks odd to recipients and makes your mail easier to mistake for spoofing.

How to fix it (Google Workspace admin)

  1. Sign in to the Google Admin console and open Apps > Google Workspace > Gmail > Authenticate email.
  2. Select your domain and click Generate new record. Keep the 2048-bit key length and the google prefix selector, unless your DNS host only accepts 1024-bit keys.
  3. At your DNS host, add a TXT record named google._domainkey with the value Google shows (it starts with v=DKIM1; k=rsa; p=).
  4. Wait for DNS to update, then come back to the Admin console and click Start authentication.
  5. Run the checker above. DKIM should show a key, and new mail will be signed with d=yourdomain.

While you are in DNS, make sure SPF includes include:_spf.google.com and that you have a DMARC record at _dmarc.yourdomain. The checker reports both.

Test that mail actually sends

DNS only tells half the story. To confirm your Gmail SMTP settings work end to end, run the online SMTP test with smtp.gmail.com on port 587.

FAQ

What is gappssmtp.com?
gappssmtp.com is a domain owned by Google. When a Google Workspace domain has no DKIM key of its own, Gmail signs outgoing messages with a default key under yourdomain-com.<date>.gappssmtp.com so the message still carries a valid DKIM signature.
Is gappssmtp.com spam or a virus?
No. It is part of Google’s own mail infrastructure. Seeing it in a header means the message was sent through Google Workspace from a domain that has not set up its own DKIM key.
Why does Gmail show "via gappssmtp.com" next to the sender?
Gmail shows "via" when the domain that signed the message differs from the domain in the From address. Here the signer is gappssmtp.com and the sender is your domain, so they do not match.
Does gappssmtp.com hurt deliverability?
It can. DMARC needs SPF or DKIM to align with your From domain. A gappssmtp.com signature never aligns, so you rely on SPF alone, and forwarded mail often fails SPF. Gmail and Yahoo also expect bulk senders to sign with their own domain.
How do I remove gappssmtp.com from my emails?
In the Google Admin console open Apps > Google Workspace > Gmail > Authenticate email, generate a 2048-bit DKIM key, publish it as a TXT record at google._domainkey.yourdomain, wait for DNS to update, then press Start authentication. New mail will be signed with d=yourdomain.
How long does it take for the change to apply?
DNS usually updates within minutes, but Google says it can take up to 48 hours before you can start authentication. Use the checker above to see when the key is live.