Hi Bruce, I found that under Security /  Antispam / Options / Enable DMARC policy compliance check       was selected and this is what was blocking Google mail as I also read Google does not run DMARC on any of their servers.

Google is actively promoting DMARC.  See the articles and links below: - all from Google, and about Google's use, and promotion of, DMARC:

Google also checks ALL INCOMING E-MAIL for DMARC records

• DOMAINKEYS (2048 bit - all 1024 bit keys, for everything, were depreciated by Microsoft and US CERT in December, 2014 because of the ability to hack smaller keys easily)
• DKIM

• rDNS - must be setup by the company which provides your STATIC IP ADDRESSES
  • SPF - must be setup in YOUR PRIMARY DNS SERVER
    • DOMAINKEY entries in DNS - there are THREE TOTAL
    • the DOMAIN KEY, a TXT record
      • 
      • which contains THREE RECORDS, shown as:
      • 
    • Entered in DNS as:
    • 
    • 
    • 
• DMARC RECORD: must be setup in your PRIMARY DNS SERVER
  • Not all DNS servers support 2048 bit DMARC records, but anything smaller than 2048 bit will be rejected by GOOGLE, so plan on updating your DNS if it doesn't support 2048 bit TXT records - which is how a DMARC record is added - as a TXT record.
  • Microsoft DNS does support 2048 bit TXT records

==================================
Google Apps features that protect against spoofing

Emails not delivered to Gmail?

If you sent an email to a Gmail user and got an automatic bounce message that says, "Unauthenticated email from [email domain] is not accepted due to domain's DMARC policy,” see the options below for more information:

• If you sent the email using Gmail, learn how to fix your settings in Gmail.
• If you sent the email using a different email application, try looking for a setting in your email application that controls the server used to send messages (the “outgoing” server). Change this setting so that you’re using the server that matches the email address you want to send from. If that doesn’t work or you need more help, contact the email provider for your email address.

To help fight spam and abuse, Gmail uses email authentication to verify if a message was actually sent from the address it appears to be sent from. As part of the DMARC initiative, Google allows domain owners to help define how we handle unauthenticated messages that falsely claim to be from your domain.

What you can do

Domain owners can publish a policy telling Gmail and other participating email providers how to handle messages that are sent from your domain but aren’t authenticated. By defining a policy, you can help combat phishing to protect users and your reputation.

On the DMARC website, learn how to publish your policy, or see the instructions for Google Apps domains.

Here are some things to keep in mind:

• You'll receive a daily report from each participating email provider so you can see how often your emails are authenticated and how often invalid emails are identified.
• You might want to adjust your policy as you learn from the data in these reports. For example, you might adjust your actionable policies from “monitor” to “quarantine” to “reject” as you become more confident that your own messages will all be authenticated.
• Your policy can be strict or relaxed. For example, eBay and PayPal publish a policy requiring all of their mail to be authenticated in order to appear in someone's inbox. In accordance with their policy, Google rejects all messages from eBay or PayPal that aren’t authenticated

 

 

Prevent outgoing spam with DMARC

Add a DMARC record

Create the record

Once SPF and DKIM are in place, you configure DMARC by adding policies to your domain's DNS records in the form of TXT records (just like with SPF or ADSP).

Follow the instructions to create a TXT record with the appropriate name and value, using the specific instructions for popular domain hosts. The TXT record name should be "_dmarc.your_domain.com." where "your_domain.com" is replaced with your actual domain name. You can also review the limitations with some domain hosts.

https://support.google.com/a/answer/2466563?hl=en

 

 

Steve, if you can't tell from Steve's response, DMARC can be complicated but is becoming a necessity to understand and utilize. SPF, DKIM, and DMARC together make for a very effective method of preventing certain types of phishing and domain spoofing. Your box for DMARC compliance should be checked. If an entity config's DMARC on their domain, they are telling the world what to do with their email if it comes from a server that doesn't belong to the domain. Google is just enforcing their wishes and you should too.

 

Like Steve said, make sure SPF and DKIM are setup correctly, then configure DMARC. 

 

Steve, adsp is generally not used anymore...

 

 

 

 

by virtue of the fact that the protocol now "supports ADSP reporting of messages that weren't signed, but should have been," this leads me to believe that this supersedes Robbie's comment that ADSP is "not used any more"

 

"Steve, adsp is generally not used anymore...

http://datatracker.ietf.org/doc/status-change-adsp-rfc5617-to-historic/

 

but in fact should be included in every DMARC record.