/ Email · infrastructure
Custom Domain Email Is Way More Complicated Than It Should Be
Gmail is retiring third-party “Send as” in January 2027. This is the $0/month replacement I built — and the long route to mail that actually authenticates as my domain.
TL;DR
I receive [email protected] through Cloudflare Email Routing into Gmail, read it in Thunderbird over IMAP, and send it through SMTP2GO. It costs $0/month on the free tiers and now returns SPF: PASS, DKIM: PASS, DMARC: PASS.
Gmail is removing third-party “Send as” in January 2027. That includes the convenient setup where a normal Gmail account sends mail that looks like it came from a custom domain. Gmail-to-Gmail and Google Workspace aliases are unaffected, but that is not what I have.
I learned DNS records for CompTIA A+, but seeing DMARC: FAIL in real mail headers still gave me a genuine “what the hell is this?” moment. I went down a goose chase because I thought the address was working. It was displaying correctly. That is not the same thing as authenticating correctly.
What I needed
- A domain with DNS managed in Cloudflare.
- A Gmail account for the mailbox I already use.
- A free SMTP2GO account for authenticated outbound mail (currently capped at 1,000 emails/month).
- A desktop client. I use Thunderbird.
What I had before
Cloudflare Email Routing was already forwarding inbound mail for my custom address to Gmail:
[email protected] | v [email protected] | v Cloudflare Email Routing | v [email protected]
For a while I used Gmail’s “Send mail as” setting. Messages had the right visible From address, but their real path was still Gmail. When I sent a test and opened Gmail’s Show original view, the headers told a different story:
From: Alex <[email protected]> Return-Path: [email protected] SPF: PASS (gmail.com) DKIM: PASS (gmail.com) DMARC: FAIL (ahlyxlabs.com)
SPF was passing, which is why I initially assumed everything was fine. The important detail is which domain passed. Gmail authenticated Gmail, not Ahlyx Labs. DMARC checks whether the authenticated identity aligns with the visible From domain, so it correctly failed.
Why I did not just use hosted business email
Google Workspace would make [email protected] a real Google-hosted mailbox. Google would receive, store, send, and authenticate the address. That is probably the cleanest architecture for a company with employees, shared calendars, provisioning, compliance requirements, or higher mail volume.
Ahlyx Labs is one person and most of the infrastructure is intentionally on free tiers. I did not want another recurring bill just for one mailbox. I also tried Zoho’s free tier, but its onboarding kept steering my domain toward www.ahlyxlabs.com, which is not the mail domain I wanted. After enough fighting with signup screens, I realized I was solving the wrong problem: incoming mail was already fine. I only needed a real outbound path.
The setup I ended up with
INCOMING sender → [email protected] → Cloudflare Email Routing → [email protected] → Thunderbird OUTGOING Thunderbird → SMTP2GO → recipient
Each service has one job. Cloudflare receives mail for the domain. Gmail stores the mailbox. Thunderbird is the client I use. SMTP2GO sends and authenticates the outbound message. DNS ties the pieces together. It is more plumbing than clicking Send in Gmail, but it costs nothing per month.
Verifying the sending domain
After creating the SMTP2GO account, I added ahlyxlabs.com as a verified sender domain. SMTP2GO generated three account-specific CNAME records. Do not copy these values from another account; use the exact values your provider gives you.
CNAME emXXXXX → provider return-path host CNAME sXXXXX._domainkey → provider DKIM host CNAME link → provider tracking host
I added each one in Cloudflare as DNS only, not proxied. Mail-authentication records are DNS records, not web services that should sit behind Cloudflare’s reverse proxy. I did not change my MX records, so inbound mail continued flowing through Cloudflare Email Routing while I worked on outbound sending.
Multiple DKIM selectors can coexist normally because different mail services publish their own selector names. Keep an inventory of active senders, and remove a stale selector only after confirming that no active service uses it.
The SPF part that confused me
I did not replace the root SPF record, which is still v=spf1 include:_spf.mx.cloudflare.net ~all. That record is for Cloudflare Email Routing, and it does not need an SMTP2GO include for this setup.
SPF is evaluated against the envelope-from domain, also called the Return-Path. A sending provider can use a delegated subdomain such as emXXXXX.ahlyxlabs.com, which CNAMEs to the provider return-path host; the provider then handles SPF at that delegated return-path. With DMARC’s default relaxed alignment, that subdomain shares the organizational domain ahlyxlabs.com. SPF can therefore both pass and align with no root-record change. That was the non-obvious piece I kept looking for in the wrong place.
Thunderbird became the glue
I connected the existing Gmail account through IMAP/OAuth so Thunderbird reads the same mailbox I already had. Then I added SMTP2GO as a separate outgoing SMTP server:
Server: mail.smtp2go.com Port: 2525 Connection security: STARTTLS Authentication: Normal password Username: <your SMTP2GO SMTP user>
I created a second Thunderbird identity with the name Alex, the address [email protected], and SMTP2GO selected as its outgoing server. Receiving and sending do not have to be handled by the same company.
Gmail’s “Send mail as” screen can route through an external SMTP server, and someone will rightly point that out. I chose Thunderbird because I wanted a dedicated client with Gmail IMAP and custom SMTP in one place, and because it sidesteps the deprecated Gmail path instead of leaning on another corner of it.
The first successful authentication test
After switching outbound mail to SMTP2GO, I sent another normal human-looking message and checked Gmail’s Show original view. The result finally looked like this:
SPF: PASS DKIM: PASS with domain ahlyxlabs.com DMARC: PASS
The headers included an aligned DKIM signature with d=ahlyxlabs.com, and the Return-Path was now under a subdomain of my own domain rather than gmail.com. That is the difference between displaying an Ahlyx Labs From address and actually authenticating as Ahlyx Labs.
Adding DMARC
Once SPF and DKIM were working, I added this DMARC record in Cloudflare:
Type: TXT Name: _dmarc v=DMARC1; p=none; rua=mailto:[email protected]
The p=none is intentional. It puts DMARC in monitoring mode and asks participating providers to send aggregate reports. I do not want receiving servers rejecting mail while I am still learning every legitimate sender for the domain.
p=none | v p=quarantine | v p=reject
Authentication already passes. Enforcement can wait until I have observed the domain in normal use.
Where this could break
- SMTP2GO’s free tier is limited to 1,000 emails each month.
- DMARC is at
p=none: monitoring, not enforcement. That is deliberate, but it does not tell receivers to quarantine spoofed mail yet. - The incoming side depends on Cloudflare Email Routing continuing to fit this use case on its free tier.
- Thunderbird is the only configured sending point. If I need to send from another device, I need to configure it safely rather than falling back to the old Gmail workflow.
Things I learned the hard way
Passing SPF does not mean your visible From domain is authenticated
Always check which domain passed. My original mail passed SPF for Gmail and still failed DMARC for Ahlyx Labs.
Incoming and outgoing mail are separate problems
I kept looking for one free provider to replace everything. I did not need one. Cloudflare was already doing inbound mail perfectly well; I only needed a better outbound path.
Do not touch MX records unless you are moving inbound mail
MX records decide where mail for the domain arrives. Changing them while experimenting with outbound SMTP would have introduced an unrelated failure mode.
Do not test deliverability with “test / test”
My first test used that exact subject and body and Gmail put it in spam. That is not proof the infrastructure is broken. Send a normal message with a normal subject and body, then read the headers.
Questions I kept asking myself
What happens to Gmail “Send as” in January 2027?
Gmail will remove “Send as” for third-party, non-Google accounts on the web and mobile apps. Google Workspace aliases and other Gmail addresses are not affected. Google’s documented alternatives include using a desktop client with IMAP/SMTP.
Why does DMARC fail when SPF passes?
DMARC needs alignment between the visible From domain and SPF or DKIM. My original SPF pass authenticated gmail.com, while my visible address was ahlyxlabs.com.
Why did I not need to change the root SPF record?
A provider can authenticate a delegated envelope-from subdomain such as emXXXXX.ahlyxlabs.com. Under relaxed alignment it shares the organizational domain with the visible From address.
Can I still receive mail in Gmail?
Yes. Cloudflare Email Routing still forwards custom-domain mail to Gmail. Nothing about the inbound path changed.
Why Thunderbird instead of Gmail’s external SMTP option?
I wanted a dedicated client that manages Gmail IMAP and SMTP2GO together, without depending on Gmail’s third-party Send as settings as they are being retired.
What does this cost?
Nothing at the time of writing: Cloudflare Email Routing, a normal Gmail account, Thunderbird, and SMTP2GO’s free tier. The trade-off is understanding and maintaining the seams.
What I am not doing yet
I am leaving DMARC at p=none for a while and watching the reports. When I am confident SMTP2GO is the only legitimate sender I need, I will update this post with the move toward p=quarantine and eventually p=reject. I also want to document what the aggregate reports actually look like once enough arrive.