I was demoing a client's transactional email flow when they spotted it. Right there in their Gmail inbox, next to the From name: "via sendgrid.net" in gray text. Small. Easy to miss. And completely undermining the brand they'd spent months building.

"Is that normal?" they asked.

Normal? Sure. Good? Absolutely not.

That "via" tag is Gmail's polite way of saying: this email claims to be from you, but someone else actually signed it. For recipients who don't understand email infrastructure — which is most people, let's be honest — it looks sketchy. Like forwarded spam. Or a phishing attempt.

We're the JustEmails team (JustEmails is built by Velocity Digital Labs — read about building 9 SaaS products), and we see this question constantly. I'll admit I underestimated how much that tiny gray label bothered people until I started counting the support tickets. The fix isn't complicated once you understand what's happening — though I did manage to botch my own DKIM setup on the first try. Here's the full breakdown.

What You'll Have at the End

A Gmail inbox where your emails display your sender name — without "via sendgrid.net" or "via mailgun.org" cluttering the From line. You'll understand exactly why the label appears and how to verify it's gone using Gmail's "Show original" view.

Prerequisites

Before you start:

Access to your domain's DNS (Cloudflare, Route53, Namecheap, whatever you use)
Admin access to your email sending service (SendGrid, Mailgun, Postmark, Amazon SES, or similar)
A Gmail account to test with (any free Gmail works)
10-15 minutes

That's it. If you've added a DNS record before, you can do this. If you haven't — well, today's the day you learn.

Step 1: Understand What Causes the Via Label

Gmail shows "via [domain]" when the DKIM signature's domain doesn't match your From address.

Here's the technical version: every email can carry a DKIM signature — a cryptographic stamp proving who signed the message. That signature includes a d= tag with the signing domain. When you send from sales@yourcompany.com but the DKIM shows d=sendgrid.net, Gmail sees a mismatch.

The message says it's from yourcompany.com. But the signature proves it came from SendGrid's infrastructure. Gmail isn't blocking it — the email still delivers. But it's flagging the discrepancy with that "via" label.

This happens by default with most email providers. Out of the box, SendGrid signs with d=sendgrid.net. Mailgun signs with d=mailgun.org. Amazon SES signs with d=amazonses.com.

Why? Because it works without any DNS setup on your end. The providers are being helpful. Kind of. But that helpfulness comes at a cost: the visible third-party badge that makes your carefully crafted emails look like they came from a bulk sender. (Which, technically, they did. But your recipients don't need to know that.)

Step 2: Check Your Current DKIM Signature

Before fixing anything, confirm the problem exists. Send a test email from whatever service is showing the via label. Send it to your Gmail account.

Open the email in Gmail. Click the three dots (more options) and select "Show original."

You'll see raw headers. Look for a line starting with DKIM-Signature. Within that block, find d=.

If it says something like:

d=sendgrid.net;

or:

d=mailgun.org;

That's your problem. The signature domain doesn't match your From domain. Gmail's going to show "via sendgrid.net" because that's who actually signed the message.

What you want to see:

d=yourcompany.com;

When the d= matches your From domain, the via label disappears.

Step 3: Enable Custom DKIM in Your Email Service

Every major email provider supports custom DKIM. The UI differs — sometimes annoyingly so — but the process is the same: they generate DKIM keys for your domain, you add CNAME records to your DNS, they start signing with your domain instead of theirs.

SendGrid:

Go to Settings → Sender Authentication → Authenticate Your Domain. Follow their wizard — they'll give you 2-3 CNAME records. Add them to your DNS. Verify in their dashboard.

Typical SendGrid DKIM records look like:

s1._domainkey.yourcompany.com.  CNAME  s1.domainkey.u12345.wl.sendgrid.net.
s2._domainkey.yourcompany.com.  CNAME  s2.domainkey.u12345.wl.sendgrid.net.

Mailgun:

Go to Sending → Domains → your domain → DNS Records. They'll list the DKIM records you need. Two TXT records typically:

pic._domainkey.yourcompany.com  TXT  "k=rsa; p=MIG..."

Postmark:

Servers → your server → Manage Signatures → your domain → DKIM. They give you a CNAME. Add it. Done.

Amazon SES:

Verified Identities → your domain → Authentication → Easy DKIM. They generate three CNAME records. Add all three. SES will detect them and start signing.

Typical SES format:

abc123._domainkey.yourcompany.com.  CNAME  abc123.dkim.amazonses.com.

(If you're using JustEmails for your mailbox hosting, DKIM is auto-configured when you add a domain — no manual record entry required. But if you're routing through a separate transactional sender, that sender still needs its own custom DKIM setup.)

Step 4: Add the DNS Records

Log into your DNS provider. Add the records exactly as your email service specifies. Watch for typos — a missing dot or wrong subdomain will break verification.

Common mistakes I've seen (and, in a few embarrassing cases, made myself):

Adding a period at the end of the hostname when your DNS provider already appends the domain. Cloudflare does this. Route53 doesn't. It's infuriating.
Mixing up the selector (s1, s2, pic, etc.)
Copy-pasting the record value with extra whitespace or invisible characters from a PDF

After adding, wait for DNS propagation. Most providers verify within 5-15 minutes. Some are near-instant. I've also seen it take an hour when working with certain registrars that cache aggressively. Patience.

Go back to your email service's dashboard and hit "Verify" or refresh the status. They'll confirm when the records are detected and DKIM is active.

Step 5: Verify the Via Label Is Gone

Send another test email from that service to Gmail. Open it. Check the From line.

No "via sendgrid.net"?

Done. Go celebrate. Or at least exhale.

But do double-check with Show original to be sure. Look for the DKIM-Signature header again. The d= should now show your domain:

d=yourcompany.com;

And further down in the headers, you should see:

dkim=pass header.d=yourcompany.com

That "pass" with your domain confirms Gmail verified your signature and didn't need to fall back to the third-party domain. The via label won't appear on this message.

Common Errors and How to Fix Them

DKIM record not found

Your DNS records aren't live yet or there's a typo. Double-check the hostname — is it s1._domainkey.yourcompany.com or s1._domainkey (with the domain appended by your DNS provider)? Run dig +short CNAME s1._domainkey.yourcompany.com to confirm the record exists.

DKIM verification failed in provider dashboard

The record exists but the content is wrong. Compare character-by-character with what the provider expects. I once spent 40 minutes debugging a record that had a smart quote instead of a regular quote. Invisible characters from PDFs are the worst.

Via label still appears after verification

The email service might cache which signing method to use. Send a fresh test email — don't reply to an old thread. If it persists, check that you're sending from the right authenticated domain. Some providers allow multiple sending domains; make sure yours is selected.

"dkim=fail" in Show original headers

The record exists but something's misconfigured. The public key in DNS doesn't match the private key being used to sign. This usually means you regenerated keys in your provider's dashboard without updating DNS. Re-grab the records and update them.

Still seeing "via" on some emails but not others

You might have multiple sending services. Check each one: your marketing tool, your transactional sender, your CRM's email feature, your support desk. Each service that sends from your domain needs its own custom DKIM setup. Miss one, and that tool's emails will still show the via label. Run our DMARC ramp guide if you're unsure what's sending from your domain — aggregate reports surface every sender.

Why This Matters Beyond the Label

Removing the via label is a visual win. But there's a deliverability angle too — and frankly, this is the part I care more about.

When Gmail sees consistent DKIM alignment — where the signature domain matches the From domain — it builds sender reputation on your domain. Not on SendGrid's. Not on Mailgun's. Yours. This distinction matters. If you're tracking email engagement alongside web analytics, tools like JustAnalytics can help you correlate deliverability improvements with conversion metrics.

Inbox placement over time gets better when you control your reputation. A domain with clean DKIM alignment and a strict DMARC policy gets treated better than one that relies entirely on third-party reputation. Google's bulk-sender requirements (in effect since February 2024) explicitly require DKIM alignment for senders over 5,000 messages/day.

For cold outreach or sales emails, the trust signal matters even more. A recipient who sees "via mailgun.org" might unconsciously downgrade the email. Is this spam? Is it spoofed? Why does it look different from other emails? Removing that label removes the question entirely.

Next Steps

Now that your DKIM is aligned:

Set up custom DKIM for every sender. Marketing tools, CRMs, ticketing systems — if it sends email as your domain, configure DKIM. One unaligned sender is enough to trigger the via label on that tool's messages.
Check your SPF and DMARC. DKIM is one leg of email authentication. SPF authorizes which servers can send for you. DMARC ties them together and tells receivers what to do with failures. For full deliverability protection, you want all three.
Consider BIMI. Once DMARC is at p=reject, you can display your brand logo in Gmail. It's the opposite of the via label — instead of a third-party flag, you get a brand asset. Our BIMI setup guide walks through the process.
Monitor ongoing. DKIM keys rotate. Services change their infrastructure. DNS records get lost when you migrate providers (ask me how I know). Check periodically that your alignment is still clean.

Questions? support@justemails.app — we've debugged plenty of DKIM misalignment issues. Some of them our own. And if you're evaluating email hosting that auto-configures authentication records, see how JustEmails compares to Google Workspace for multi-domain setups.

Frequently Asked Questions

Why does Gmail show 'via' next to my sender name?

Gmail displays 'via thirdparty.com' when the DKIM signature on your email uses a different domain than your From address. If you send from hello@yourdomain.com but the DKIM is signed with d=sendgrid.net, Gmail flags it. The fix is enabling custom DKIM signing through your email provider so the signature uses your own domain.

Will the via label hurt my email deliverability?

Not directly — Gmail still delivers the email. But it hurts trust. Recipients see 'via sendgrid.net' and wonder if the email is legitimate. For sales outreach, marketing campaigns, and transactional emails, that visible third-party flag can reduce open rates and replies. Fixing DKIM alignment removes the label and looks more professional.

How long does it take for the via label to disappear after adding custom DKIM?

Once your custom DKIM records are live and your provider is signing with your domain, new emails should appear without the via label immediately. Gmail doesn't cache the old state — it checks each message. Send a test email to a Gmail account and open 'Show original' to verify the DKIM domain. If dkim=pass shows your domain, the label is gone.

Do I need custom DKIM even if I'm using Google Workspace?

If you're sending directly from Google Workspace with no third-party senders, DKIM is already aligned — Google signs with your domain. You won't see a via label. But if you route mail through a marketing tool, transactional API, or SMTP relay, each of those services needs its own custom DKIM setup on your domain. One unaligned sender is enough to show the label on that sender's messages.

Try JustEmails

$49/year. Unlimited domains. Unlimited mailboxes. 10 GB storage included. Full IMAP/SMTP. Auto-configured SPF, DKIM, DMARC, and MTA-STS — no DNS gymnastics required. Built for agencies, freelancers, and anyone tired of paying per-user for multi-domain email.

Start your 7-day free trial → · How it compares

Why Gmail Shows 'via' Next to Your Sender Name (and How to Remove It)