Gmail's New Email Auth & RSA-SHA1 Removal

What’s changing in Gmail’s email authentication and why it matters

You send emails to thousands every day. You’ve set up DKIM, double-checked your SPF, and thought you were good to go. But Gmail is quietly rewriting the rules — and if you’re still using RSA-SHA1 for email authentication, your messages might not make it to the inbox by 2026.

Gmail is phasing out support for RSA-SHA1 in email authentication, part of a broader shift toward modern cryptography. It’s not an overnight change, but it’s coming. Senders who haven’t updated their DKIM signatures or certificate configurations risk message rejection or degraded deliverability — especially those sending at scale.

Key takeaways

Gmail will stop supporting RSA-SHA1 in email authentication by 2026, impacting older DKIM key configurations.
Senders using outdated cryptographic standards may face message rejection or lower inbox placement, particularly in bulk email campaigns.
Transitioning to modern algorithms like SHA-256 with RSA or ECDSA is required to maintain deliverability with Gmail.

How does RSA-SHA1 removal impact your email deliverability?

You’re at risk of email deliverability issues if your messages use RSA-SHA1 signatures, as Gmail now flags them as insecure. Even if your email is valid and properly sent, outdated authentication increases the odds your message gets filtered as spam or outright rejected—especially during bulk sends. This isn’t hypothetical: modern cryptographic standards no longer consider RSA-SHA1 safe. Gmail’s filtering systems now treat these signatures as higher risk, lowering your sender reputation.

Why RSA-SHA1 is no longer acceptable

SHA-1 was once standard, but it’s been widely deprecated due to known vulnerabilities. The National Institute of Standards and Technology (NIST) officially deprecated SHA-1 in 2011, and modern email infrastructure follows that guidance. Gmail, as a major mail provider, now enforces stricter checks—especially around DKIM signatures—making RSA-SHA1 a red flag. If your domain still uses it, your messages arrive with a higher perceived risk, even if everything else is correct.

Let’s be clear: this isn’t about whether your email is technically valid. It’s about trust. Secure authentication is how receivers validate that a message genuinely comes from the domain it claims. When that trust layer is weak, Gmail applies heavier scrutiny. In high-volume sending scenarios, this can lead to automated rejections—even if you’re not sending spam.

What you can do right now

If you’re not already auditing your email chain, now’s the time to act. Check your DMARC reports and verify that your DKIM signatures use stronger algorithms like RSA-SHA256 or ECDSA. Most email platforms and ESPs (like SendGrid, Mailchimp, HubSpot) now default to secure methods, but older setups or third-party tools may still rely on outdated keys.

You can test whether your current setup meets today’s standards. Use a real-time email verification tool to validate your sending domain’s authentication. Tools like MailTester’s inbox placement test can show you how your message is received in Google’s inbox, including whether authentication issues are blocking delivery.

For teams with large lists, run a bulk verification to catch outdated or insecure domains before sending. MailTester’s bulk list verification checks each address for validity, catch-all status, and domain health—including authentication readiness. It’s faster than manual checks and gives you a clear picture of what’s at risk.

For ongoing use, integrate a real-time verification API to validate every new subscriber before sending. MailTester’s API checks for invalid, disposable, or insecure addresses—catching issues before they harm your deliverability.

Secure authentication isn’t optional. Gmail’s shift away from RSA-SHA1 reflects broader industry trends. The longer you wait, the more your sender reputation pays the price.

What exactly is RSA-SHA1 and why is it being deprecated?

RSA-SHA1 is a digital signature method that combines RSA encryption with the SHA-1 hash function to verify email authenticity. It’s being phased out because SHA-1 is vulnerable to collision attacks—where two different inputs produce the same hash—making it unreliable for security-critical tasks like email validation. Major platforms including Google, Microsoft, and Apple now require stronger algorithms like RSA-SHA256 for secure email authentication.

The problem with SHA-1

SHA-1 was once considered secure, but researchers have demonstrated practical collision attacks since 2017. This means an attacker could create two different emails with the same hash, making forged messages appear legitimate. As a result, relying on SHA-1 for email signatures is no longer acceptable for trust frameworks like DKIM.

When you sign an email with RSA-SHA1, you’re saying: "This message came from this domain and hasn’t been altered." But if the underlying hash function can be manipulated, that promise breaks down. That’s why standards bodies like IETF and major email providers are retiring it.

What’s replacing it?

Google, Microsoft, and Apple have all moved to stronger algorithms—primarily RSA-SHA256—which use a more secure hash function and longer key lengths. These are resistant to known attacks and meet current cryptographic standards. The shift isn’t sudden; it’s part of a gradual deprecation process across the email ecosystem.

For email senders, this means your DMARC, SPF, and DKIM records must use modern signing methods. If you’re still using RSA-SHA1, your emails may fail authentication checks and end up in spam folders—or not deliver at all.

Let’s be clear: you don’t need to worry about this if your email infrastructure is up to date. But if you're running old systems or using tools without recent updates, it’s time to check your configuration. You can test how well your domain passes modern authentication checks with real-world inbox placement tools.

Tools like the inbox placement tester help verify whether your authenticated emails are being trusted by major providers—including Gmail—by simulating delivery across real inboxes. If your domain still uses RSA-SHA1, you’ll likely fail the check.

For more detail on how modern email authentication works, see RFC 6376, which defines DKIM and details the transition to stronger algorithms. The IETF continues to track cryptographic best practices to ensure long-term email security.

How to check if your DKIM setup uses RSA-SHA1

You can check if your DKIM setup uses RSA-SHA1 by looking up your domain’s DKIM TXT record via a public DNS tool like MxToolbox. Search for the a=rsa-sha1 tag in the record — if it’s present, your email authentication uses a deprecated algorithm and should be updated to avoid delivery issues with Gmail and other major providers.

Step-by-step: Find and verify your DKIM algorithm

Go to a DNS lookup tool like MxToolbox or DNSWatch. These tools provide reliable access to your domain’s DNS records without requiring API access.
Enter your domain name in the DKIM lookup field. Include your DKIM selector (e.g., default._domainkey.example.com) if you know it — otherwise, try common selectors like google._domainkey or mail._domainkey.
Review the returned TXT record. Look for the a=rsa-sha1 tag. If it appears, your DKIM signature uses the outdated hashing algorithm.
If the tag is missing, your domain likely uses a newer algorithm like a=rsa-sha256, which is required by modern email providers including Gmail. If a=rsa-sha1 is present, proceed to update your DKIM record.

Why this matters for deliverability

Gmail has started enforcing stricter authentication standards. Algorithms like rsa-sha1 are no longer supported because they’re mathematically weak and vulnerable to collision attacks. Using them risks your emails being rejected or marked as spam.

Even if your emails are still delivering now, updating your DKIM record proactively prevents sudden delivery failures when Gmail fully enforces the change. You can verify the new record’s validity using the same DNS tools, or test sending through a service like MailTester’s Inbox Placement Tester to simulate how your emails perform across major inboxes.

For large-scale verification across entire mailing lists, consider using the MailTester bulk verification tool. It checks domain and email health in real time and flags authentication issues like deprecated DKIM signatures, so you can fix problems before they impact deliverability.

What steps should you take to update your DKIM configuration?

You need to generate a new DKIM key using RSA-SHA256 or ECDSA, update your DNS TXT record with the new selector and algorithm, validate it resolves correctly using tools like Google’s diagnostic checks, and monitor outbound emails for delivery issues during the transition period. This ensures your messages pass Gmail’s stricter authentication standards and avoid being flagged as suspicious.

Generate and deploy a new DKIM key

Generate a new DKIM key using RSA-SHA256. While ECDSA is acceptable, RSA-SHA256 remains the most widely supported and recommended standard for interoperability. Gmail and other major providers now reject messages signed with deprecated algorithms like RSA-SHA1.
Use your email platform or email service provider’s key generation tool. Most modern platforms (e.g., SendGrid, Amazon SES, Microsoft 365) support RSA-SHA256 directly. If using a custom setup, ensure your cryptographic library supports SHA256.
Choose a unique selector (e.g., mailtest1) that doesn’t conflict with existing keys. The selector is part of the DNS record name and helps identify which key is being used.

Update DNS and verify configuration

Update your DNS TXT record with the new selector, public key, and the correct signature algorithm. The record should include the verifier tag and specify rsa-sha256 or ecdsa-sha256 in the h= field, per RFC 6376.
Use a DNS lookup tool like MxToolbox or DKIM Validator to confirm your TXT record resolves correctly. Check for syntax errors, missing fields, and duplicate records.
Test your configuration with Gmail’s postmaster tools. You can submit a sample message via the Google Postmaster Tools dashboard to validate DKIM signing and alignment in real time.
Monitor outbound sends over the next 72 hours. Some messages may temporarily fail due to validation delays or caching. Use your ESP’s delivery logs to track errors and correlate them with configuration changes.

Transitioning to RSA-SHA256 is not optional if you rely on Gmail’s inbox placement. Messages signed with outdated algorithms are more likely to be filtered, especially from high-volume senders.

Running a real-time verification test on your list can help prevent sending to addresses that are already rejecting new authentication standards. Use our email checker to validate individual addresses before sending, and test inbox placement to see how your emails perform in actual Gmail inboxes.

Why verifying email addresses now is critical ahead of the RSA-SHA1 cutoff

You can’t afford to send emails to outdated or misconfigured addresses as Gmail phases out RSA-SHA1, a legacy encryption method used in DKIM signatures. Many old or invalid addresses carry outdated DKIM records that no longer comply, causing bounces, damaging sender reputation, and wasting send resources. Proactively verifying your list identifies these risky addresses before they cause issues.

The 3 steps described in “Generate and deploy a new DKIM key”, in order.

DKIM misconfigurations are hidden risks in outdated lists

Many email addresses that haven’t been cleaned in years still point to domains with outdated or insecure DKIM settings — including RSA-SHA1, which Gmail is now deprecating. When you send to these addresses, the receiving server may reject your message during authentication, even if the email format looks valid. This triggers hard bounces, harms domain reputation, and can lead to IP-level scrutiny.

Let’s be clear: a valid-looking address isn’t necessarily safe to send to. An address might be syntactically correct and technically "deliverable" — but if its domain uses an obsolete DKIM signing method, your email might still fail validation. According to published standards from the IETF (the body that defines internet protocols), RSA-SHA1 is no longer recommended for new implementations, and major providers like Google are acting on that guidance.

Verify bulk lists to catch risky addresses before they fail

Bulk email verification tools detect not just syntax or mailbox existence, but also whether the domain’s authentication setup — specifically DKIM — is current and secure. The best tools check DNS records, validate SPF and DKIM alignment, and flag addresses with known weak or outdated configurations. MailTester’s verification engine uses real-time SMTP and DNS checks to surface these issues, helping you avoid sending to addresses that will fail authentication.

For example, if a domain still uses RSA-SHA1 for DKIM, MailTester will mark it as high-risk or flag the address as “risky” during verification. That gives you a chance to remove it before sending. This applies to both old lists and new ones — especially if your data includes legacy signups, abandoned accounts, or purchased lists.

You don’t need to wait for the first delivery failure to act. Start now: clean your list with a tool that checks for authentication issues, not just delivery potential. Bulk verify your entire email list — including DKIM security — and send with confidence before the RSA-SHA1 cutoff affects your deliverability.

How MailTester helps future-proof your email list against authentication risks

You can’t rely on Gmail’s evolving standards to fix outdated or missing authentication on your email list. MailTester checks each address in real time or bulk, pinpoints those with weak or missing email authentication—like old or unsupported algorithms such as RSA-SHA1—and flags them as risky before you send. This is how you stay ahead of bounce rates and deliverability drops before they happen.

Spotting risks early with real-time accuracy

Gmail’s recent shift away from RSA-SHA1—aligned with broader industry moves to phase out outdated cryptographic standards—means any email infrastructure relying on it may now be blocked or deprioritized. MailTester doesn't just verify deliverability; it checks for whether an address lives on a domain that complies with current email authentication protocols like SPF, DKIM, and DMARC. This means you catch issues before they cause a send to fail or land in spam.

With 98.9% accuracy, our validation process goes beyond basic syntax checks. It examines the underlying domain reputation, checks for catch-all configurations, and confirms the mailbox exists. If a domain has weak or missing authentication, MailTester marks the address as risky, giving you a clear signal to either clean it or avoid it.

Automate verification into your workflow

Let’s say you're using Mailchimp, SendGrid, or Klaviyo. You can connect MailTester directly through our integrations, so each list upload is automatically scrubbed before sending. No more guessing whether a contact still exists or if their domain is secure.

For developers, our real-time verification API lets you validate addresses at the point of capture—whether on a landing page, sign-up form, or dashboard. This prevents invalid or poorly authenticated emails from ever entering your database.

Or if you’re cleaning an existing list, bulk verification runs thousands of checks in minutes. You’ll see exactly which addresses are at risk due to outdated algorithms, catch-all configurations, or unverified domains—all without touching a single line of code.

As email standards evolve, consistency matters. Tools like MailTester help you treat authentication not as a one-time check, but as an ongoing part of list hygiene. That’s how you maintain inbox placement, protect sender reputation, and scale reliably. The RFC 8314 (2018) standard, for instance, already advised phasing out RSA-SHA1 for email signatures—a signal that security updates are now mandatory, not optional.

What happens if you ignore Gmail’s new standards?

You risk having your emails silently blocked, especially if your domain still relies on outdated cryptographic standards like RSA-SHA1. Gmail’s transition away from legacy protocols means non-compliant messages are increasingly rejected without a bounce or warning — even if your sender reputation is strong. This can lead to undetected delivery failures and broken customer journeys.

Messages may be dropped without a trace

Gmail is phasing out support for weak cryptographic algorithms, including RSA-SHA1, which are no longer considered secure. If your email infrastructure still uses them, your messages may be rejected during the transport layer — often before they even reach the recipient’s inbox.

These rejections happen silently. Unlike a bounce with a clear error code, you’ll get no notification. That means you’re not aware of delivery failures, and your campaign performance data becomes unreliable. The email simply vanishes.

According to the Internet Engineering Task Force (IETF), SHA-1 has been deprecated due to known vulnerabilities, and modern email systems are following suit. It’s not just Gmail — other major providers are moving in the same direction. The shift is inevitable, not optional.

Even compliant senders face risks if list hygiene is poor

Ignoring modern standards doesn’t just affect technically non-compliant senders. Even if your setup is currently compliant, weak list hygiene can still degrade inbox placement over time.

Old, invalid, or inactive addresses in your list increase the chances of bounce-related reputation damage. Gmail’s algorithms penalize senders with high bounce rates, especially when they come from outdated or poorly maintained domains. This applies even if your messages are technically signed and encrypted properly.

Let’s say you verify your list before sending. A tool like MailTester’s bulk verification can identify invalid, catch-all, and disposable addresses upfront — reducing the risk of sending to dead or low-quality inboxes. It doesn’t fix outdated cryptographic setups, but it does prevent you from building a reputation based on poor data.

There's no grace period for this shift. The move is already underway, and providers are tightening enforcement. You can’t afford to wait until after delivery starts to find out your messages are being dropped. Check your infrastructure now, and clean your list.

Best practices to ensure compliance before 2026

You must audit your sending domains annually for DKIM algorithm usage, validate both syntax and cryptographic integrity, clean your list of role accounts and disposable domains, and test inbox placement to simulate Gmail’s filtering. These steps ensure your emails remain deliverable after Gmail phases out RSA-SHA1.

Daily checks: domain and DKIM integrity

Run a full DKIM algorithm audit on all your sending domains at least once a year. Gmail's 2026 deprecation of RSA-SHA1 means older algorithms will no longer be trusted.
Use tools that verify not just DKIM syntax—but actual cryptographic integrity. A valid-looking signature can still fail if the algorithm is outdated.
Check your public DNS records against RFC 6376 for correct DKIM record formatting. Misconfigured or malformed records cause silent failures.

Pre-send hygiene and real-world testing

Remove role accounts (like admin@, support@, sales@) and disposable domains from your email lists. These are high-risk for rejection and harm sender reputation.
Perform regular list hygiene using a tool that flags invalid addresses and catch-alls. For example, some systems treat a valid MX but no mailbox as a "catch-all" — which Gmail may filter.
Test your actual deliverability using inbox-placement tools. This simulates how Gmail’s filters treat your message in real inboxes. MailTester’s inbox tester helps you see how your emails land: https://mailtester.com/inbox-tester/.
Integrate a real-time verification API like MailTester’s to catch bad addresses before sending: https://mailtester.com/api-email-checker/.
For large lists, use bulk verification to clean and validate every address. This reduces bounce rates and protects your domain reputation: https://mailtester.com/email-list-verify/.

Even with valid DKIM, a poor sender reputation or high bounce rate can get your email filtered—verification alone isn’t enough. Clean lists and tested delivery are the real foundation.

Gmail's 2026 changes aren’t just about cryptography—they’re about trust. If your email consistently fails to reach inboxes, it doesn’t matter what algorithm you use. Focus on measurable deliverability signals: valid addresses, clear sender alignment, and consistent sending patterns. Tools like the ones above let you test and verify before you send, giving you a real-time view of deliverability. The deadline is not arbitrary—RSA-SHA1’s removal is part of an industry-wide shift toward modern, secure key exchange. Start now, test often, and build your compliance plan around action, not hope.

How inbox-placement testing protects you from hidden delivery issues

You don’t just need valid email addresses—your messages must actually land in inboxes, not spam folders. Gmail’s evolving authentication requirements, including the removal of RSA-SHA1, mean even technically correct emails can be blocked or filtered. Inbox-placement testing simulates real delivery across major providers, exposing hidden delivery failures before you send, so you can fix issues like weak authentication or sender reputation risks before they hurt your campaign results.

Real messages, real inboxes, real results

MailTester’s inbox-placement testing doesn’t just verify syntax—it sends live messages to actual inboxes at Gmail, Outlook, Yahoo, and others. This gives you insight into how your email will be received, not just if it was delivered. It’s not enough for an email to reach a server; it must pass filtering based on reputation, alignment, and current standards like DMARC and TLS enforcement.

Let’s say your email passes all technical checks—SPF, DKIM, and DMARC are set—but the message still lands in spam. This can happen when providers apply additional scrutiny to outdated cryptographic methods, like RSA-SHA1 (now removed from Gmail’s accepted algorithms). Inbox placement tests catch these cases early, showing you if your authentication setup is triggering filters even if delivery technically succeeds.

Stop surprises before they cost you

Testing before a high-volume send is a way to avoid costly delivery failures. If your emails hit spam or fail to deliver past the inbox, it impacts engagement, reputation, and your ability to reach customers. Inbox placement reveals whether your content, sender identity, or encryption setup is causing issues.

You can also use MailTester’s inbox placement tool to validate your setup across providers, especially when rolling out new campaigns or switching sending platforms. It’s a critical step for anyone managing large mailings, as it confirms not just that an email is valid, but that it will actually be seen.

For deeper context, the IETF’s RFC 8314 describes the deprecation of SHA-1 in digital signatures, which applies to email authentication. Major providers, including Google, now require modern algorithms like RSA-SHA256. You can review the standard here: RFC 8314.

Final takeaway: preparation is the only way to avoid disruption

Gmail’s removal of RSA-SHA1 is not a single event. It’s a signal of ongoing, non-negotiable security upgrades that will continue to shape email infrastructure.

Ignoring list hygiene or delaying verification risks higher bounce rates, degraded sender reputation, and reduced inbox placement — even if your emails are legitimate.

What to do now

Use MailTester’s real-time API to validate individual emails during sign-up or onboarding.
Run bulk verification on your existing lists to catch invalid, disposable, or role-based addresses before sending.
Test deliverability with simulated sends to ensure your setup meets current standards.

Sources

At regional mailbox providers, 15.5% of email goes missing without a trace versus only 2.8% filtered to spam — the inverse of the pattern at Gmail, Microsoft, Yahoo, and Apple. — Validity 2025 Email Deliverability Benchmark Report (2025)
Gmail requires bulk senders to keep user-reported spam rates below 0.3%, warning that rates above 0.1% already hurt inbox delivery — just 3 complaints per 1,000 emails crosses the line. — Google Email Sender Guidelines FAQ (2024)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

When does Gmail stop supporting RSA-SHA1?

There is no publicly confirmed deadline, but gradual deprecation has begun. The transition is expected to be complete by 2026.

Do I need to update my DKIM if I use a managed email service?

Yes. Many ESPs still default to RSA-SHA1. Check your provider’s documentation or support to confirm your DKIM configuration uses modern algorithms.

Can expired or invalid email addresses cause authentication issues?

Not directly. However, sending to expired addresses with broken or outdated DKIM records can hurt sender reputation and trigger rejection.

What’s the difference between DKIM and DMARC?

DKIM authenticates the content of the message; DMARC defines policies for handling messages that fail authentication.

How often should I validate my email list?

At least quarterly. More frequent validation is recommended for high-volume senders or before major campaigns.

Does MailTester test for DKIM cryptographic strength?

Yes. It includes evaluation of DKIM setup validity and flags records using outdated algorithms like RSA-SHA1.

Are disposable emails affected by RSA-SHA1 removal?

Disposable domains often lack DKIM entirely. They are inherently low-reputation and should be excluded regardless of cryptographic standards.

Can a clean email list still be rejected due to authentication?

Yes. If the sender’s domain or DKIM signature is misconfigured, even valid addresses may be blocked.

What’s the most common authentication mistake in email marketing?

Using RSA-SHA1 instead of RSA-SHA256 in DKIM, or failing to align SPF and DKIM with the sending domain.

How much do email authentication issues cost in lost deliveries?

Studies show up to 5% of emails are rejected due to authentication failures, especially among unsophisticated senders.

Can I test my email delivery without sending to real inboxes?

No. Only real inbox placement testing, like MailTester's, reveals how filters and spam engines treat your message.

Is RSA-SHA1 removal only affecting Gmail?

No. Major providers like Yahoo, Microsoft, and Apple are moving toward the same standard. It's a broad industry shift.