Gmail 'via' label: what it means and how to remove it

The 'via' label in Gmail appears next to a sender's name when the message was sent through a different domain from the one in the From address, for example 'Acme via mail.example.net'. Google's help page lists the cases: the sending domain does not match the From domain, or the message came through a Google Group from a domain whose DMARC policy is quarantine or reject. For mail sent by an app, you remove the label by authenticating the From domain with your sending service so the signing domain matches it.

Gmail does not give recipients a setting to hide it. The label is Gmail telling the reader where a message came from, so the fix is always on the sender's side.

What the via label means

A message has two kinds of sender. The From address is the one the reader sees. Behind it sit the identities that authenticate the message: the DKIM signing domain (the d= value in the DKIM-Signature header) and the envelope sender, also called the Return-Path or MAIL FROM address, which SPF checks. When these point at a domain other than the From domain, Gmail shows that other domain after 'via'.

This is common with sending services. If you send from hello@acme.com but the service signs with its own domain and uses its own bounce address, Gmail can show 'Acme via mail.example.net', with the service's domain after 'via'. Nothing is broken in the sense that the message is delivered. But the reader sees a third party's name beside yours, and a label like that can look like a sign of a forged sender.

Why your emails show 'via'

• The sending domain is not authenticated with your provider, so the provider signs with its own domain.
• The DKIM record is published but not yet verified, or was published at the wrong name, so the provider falls back to its own signing domain.
• You send from a subdomain address, such as receipts@mail.acme.com, and your provider may require separate verification for that subdomain. Check whether it inherits authentication from the root domain, then inspect the message's authentication results.
• The envelope sender is on the provider's domain. This is the default with many providers unless you set up a custom return-path.
• A second system sends as your domain, such as a CRM, help desk or old provider, and it is not set up to sign as you.
• The message passes through a Google Group, and your domain has a DMARC policy of quarantine or reject.

How to find out which domain Gmail is showing

• Open the message in Gmail, then choose 'Show original' from the three-dot menu.
• Read the summary at the top. It shows SPF, DKIM and DMARC as PASS or FAIL, with the domain each one checked.
• Open the Authentication-Results header and note which domains passed SPF and DKIM. A message can carry more than one DKIM-Signature, so a signature from your provider's domain next to a passing signature for your own domain is harmless.
• Look for a domain in the d= value of the DKIM-Signature header, or in the Return-Path header, that is not your From domain. If SPF passes only for a provider's Return-Path domain, or DKIM passes only for the provider's d= domain, that is the likely source of the domain after 'via'.

How to remove the via label

• Add the sending domain to your provider and publish every DNS record it gives you at your DNS host. Copy the names and values exactly.
• Make sure the DKIM record is the one that signs your mail. Once your provider reports the domain as verified, new messages should be signed with d= set to your domain.
• Send from an address on the domain you verified. A From address on any other domain is signed by whoever signs it.
• If the label still shows because of the envelope sender, ask your provider whether it supports a custom return-path (a bounce domain on your own domain) and set it up.
• Publish a DMARC record so receivers can see that your domain's mail is authenticated. Start with a policy of none and add an rua address to read the reports.
• Send a new test message to a Gmail address and open 'Show original' again. Old messages keep the label they were delivered with.

Some mailbox providers cache what they have learned about a sender, and a record change can take time to be seen. If a message sent straight after a DNS change still shows the label, wait for the records to propagate, send again and compare the headers.

The spam guide covers SPF, DKIM and DMARC in more detail, and how to read headers when a message fails a check. Why your emails go to spam

How Boundry handles it

When you add a sending domain to a Boundry project, Boundry returns the DNS records to publish, including a DKIM record at a selector on your own domain, an SPF record and a DMARC record. The domain counts as verified once Boundry observes every required record. A from address must belong to a domain verified in the same project. Because the DKIM record lives on your domain, mail sent from that domain can be signed as your domain, which is what Gmail looks at for the label.

A custom return-path, a bounce domain of your own, is listed on Boundry's pricing page as Enterprise only ('Talk to us'); the Sandbox, Developer and Business plans do not include it. Boundry cannot promise that Gmail will never show a label for any particular message, because Gmail makes that decision from the headers of each message. Read the original message headers to see what Gmail saw.

The domains guide lists every record Boundry asks for and how to verify them. Read the sending domains guide

If your domain's DNS is at GoDaddy, this guide shows where each Boundry record goes and how to fill in GoDaddy's Name field. Add Boundry's DNS records in GoDaddy

Pricing lists which plans include a custom return-path. See Boundry pricing

The sender name and reply address are part of how a message looks to the reader. The no-reply guide covers both. No-reply email addresses

Authentication failures can also show up as bounces. The bounces guide explains the codes. Email bounces, explained