How to Set Up SPF, DKIM and DMARC for Google Workspace

Why three records

• SPF — a list of servers allowed to send email on behalf of your domain.
• DKIM — a digital signature on every message: the recipient checks that it really comes from you and wasn’t altered on the way.
• DMARC — a rule for recipients: what to do with a message that fails the checks, and where to send reports.

All three records are added in DNS at your domain registrar or host — wherever your domain records are managed. In the Google Workspace Admin console you only generate the DKIM key.

Step 1. SPF

Create a TXT record for the root domain (the host field is usually @) with the value:

v=spf1 include:_spf.google.com ~all

If your domain already has an SPF record — for hosting email or a newsletter service, for example — don’t create a second one. Add Google to the existing record:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Here the second include is an example for Mailchimp. Two separate SPF records on one domain break the check.

Think of every service that sends email from your domain: your website, CRM, newsletters. If your site sends enquiries through your host’s mail server, it needs to be in SPF too — or set up your site to send through Google Workspace SMTP.

Step 2. DKIM

1. In the Google Admin console, open Apps → Google Workspace → Gmail → Authenticate email.
2. Select your domain and click Generate new record.
3. Choose a 2048-bit key if your registrar supports it. Leave the selector prefix at the default — google.
4. Copy the host name (google._domainkey) and the TXT record value.
5. Add this TXT record to your domain’s DNS.
6. Go back to the console and click Start authentication.

DKIM checks start working within 48 hours of adding the record. If Gmail has only just been turned on for your organisation, you’ll be able to generate the key after 24–72 hours. If your DNS panel won’t accept the long key value, choose a 1024-bit key.

Step 3. DMARC

48 hours after setting up SPF and DKIM, create a TXT record with the host _dmarc. Start with a relaxed policy that blocks nothing and only sends reports:

v=DMARC1; p=none; rua=mailto:This email address is being protected from spambots. You need JavaScript enabled to view it.

Replace the address with your own mailbox for reports. The v and p tags must come first.

Once the reports show that all your legitimate senders pass, tighten the policy gradually: first p=quarantine — suspicious messages go to spam — then p=reject — such messages are refused. Don’t rush: a strict policy with a forgotten sender will cut off that sender’s email too.

Step 4. Check the result

• Send a message from your mailbox to any Gmail address, open it and choose Show original. SPF, DKIM and DMARC should all say PASS.
• Your domain records are easy to check with Check MX from the Google Admin Toolbox.

Common mistakes

• Two SPF records instead of one.
• A forgotten sender: your CRM or website sends email from your domain but isn’t in SPF and doesn’t sign with DKIM.
• The DKIM record is added, but Start authentication wasn’t clicked in the console.
• Going straight to p=reject, so some legitimate email stops arriving.
• Records added in the wrong panel: the domain’s DNS is managed somewhere other than you think.

In short

1. SPF: one record with include:_spf.google.com and all your other senders.
2. DKIM: generate the key in the Admin console, add the google._domainkey TXT record and click Start authentication.
3. DMARC: after 48 hours, a _dmarc TXT record with p=none and a reporting address.
4. Check for PASS in Show original.
5. Tighten DMARC gradually, based on the reports.

If you’re just moving to Google Workspace or your emails keep landing in spam, we can connect Google Workspace email to your domain: set up Workspace, configure DNS, create mailboxes and test delivery.