Set up SPF, DKIM and DMARC on Google Workspace

The three DNS records that make Gmail trust your Google Workspace mail — copy them in, switch authentication on, and confirm it landed.

Check your setup free → Google Workspace docs ↗

Before you start

What Google Workspace needs from your DNS.

Google Workspace sends your mail, but Gmail and every other receiver judge it on what your DNS says, not on the fact that Google carried it. SPF authorises Google's servers to send for you, DKIM signs each message so tampering shows, and DMARC ties both to the domain your recipients see and tells receivers what to do when they fail.

Almost none of this is on by default. DKIM in particular ships inactive: the key sits generated in your Admin console, but until you publish it in DNS and click Start authentication, every message you send is unsigned. That one missed click is the single most common reason a Google Workspace domain fails DKIM.

Since February 2024, Google requires anyone sending in bulk to Gmail users to publish SPF, DKIM and a DMARC record. On Google Workspace, authenticating is no longer good practice you can defer — it is the gate to your own recipients' inboxes.

The records to publish

Copy these into your DNS.

Add each record at your DNS provider — the company where your domain is registered, not Google Workspace. Then run the checker to confirm every one resolves.

SPF record

host @ type TXT

v=spf1 include:_spf.google.com ~all

One SPF record only. If other services send for you — a CRM, a newsletter tool — add their include: to this same line rather than publishing a second SPF record, which is an error that voids both.

DKIM record

host google._domainkey type TXT

value generated by Google Workspace

Generate the key in the Admin console (Apps → Google Workspace → Gmail → Authenticate email), choose the 2048-bit length, publish the TXT value it gives you here, then click Start authentication — the record does nothing until you do.

DMARC record

host _dmarc type TXT

v=DMARC1; p=none; rua=mailto:[email protected]

Start at p=none to watch who sends as you, then raise to quarantine and reject once your reports show every legitimate sender aligning. Point rua at an address you actually read.

Step by step

The whole setup, in order.

1 Publish SPF at your DNS host. At your registrar or DNS provider — not in Google — add the TXT record above at the root of your domain. If an SPF record already exists, edit it to include _spf.google.com rather than adding a new one.
2 Generate the DKIM key in the Admin console. Go to Apps → Google Workspace → Gmail → Authenticate email, pick your domain, choose the 2048-bit key length and the default selector (google), and generate it.
3 Publish the DKIM record, then start authentication. Add the TXT it produces at google._domainkey in your DNS, wait for it to resolve, then come back and click Start authentication. Skipping this last click leaves your mail unsigned even though the record is live.
4 Publish DMARC. Add the _dmarc TXT record above. Begin at p=none so you break nothing while you read the reports, and keep the rua address pointed somewhere you will see it.
5 Wait, then verify. Google can take up to 48 hours to detect DKIM. Once it has, run a full check here to confirm SPF resolves under the 10-lookup limit, the google selector is found, and DMARC is graded.

Where it goes wrong

The mistakes specific to Google Workspace.

DKIM record live, mail still unsigned The record resolves but you never clicked Start authentication in the Admin console. Until you do, Google does not sign your outbound mail.

A 1024-bit key Older setups default to 1024-bit, which Google and Yahoo treat as weak. Regenerate at 2048-bit and republish.

A second SPF record Adding v=spf1 include:_spf.google.com as a new record alongside an existing one is a permerror. Merge every sender into a single SPF line.

SPF on the wrong name The record belongs at the root of the domain you send from, not on a www or mail subdomain.

A split DKIM value The 2048-bit key is long; some DNS panels split it across quoted strings. That is fine as long as it stays one logical TXT record — do not create several.

Impatience Testing DKIM minutes after publishing shows a failure that is only propagation. Give it time before you conclude anything is wrong.

Confirm it worked

Do not trust it until you have checked it.

DNS takes a few minutes to propagate. Once it has, run a full check: it reads all three records live, counts your SPF lookups, confirms the Google Workspace DKIM selector resolves, and grades your DMARC policy — the exact things that decide whether Gmail and Outlook trust your mail.

Check your domain → Or send a test email

Common questions

About Google Workspace, specifically.

What is the SPF record for Google Workspace? v=spf1 include:_spf.google.com ~all, published as a TXT record at the root of your domain. If other services also send for you, add their include: to the same record — never publish two.

What is the Google Workspace DKIM selector? google by default, so the record lives at google._domainkey. The key itself is generated in the Admin console under Authenticate email; publish the value it gives you and then click Start authentication.

Why is my Google Workspace DKIM not working? Almost always one of three things: you published the DNS record but never clicked Start authentication in the Admin console; the key is 1024-bit and treated as weak; or you are checking before DNS has propagated. Google can take up to 48 hours to detect it.

Do I need DMARC for Google Workspace? Yes if you send in bulk to Gmail — Google has required it since February 2024. Start at p=none with a report address, then move to quarantine and reject once your reports show every legitimate sender aligning.

Where do I add these records — in Google or at my registrar? At your DNS host: the registrar or provider that controls your domain's DNS. Google generates the DKIM value, but every record is published in your own DNS, not inside Google Workspace.

How long does Google Workspace DKIM take to activate? Up to 48 hours for Google to detect the published record after you start authentication, though it is often much faster. Do not conclude it has failed until that window has passed.

Set it once. Know it stays set.

A DKIM key rotates, a vendor changes its SPF, an IP gets listed — and your carefully-configured domain quietly breaks. Monitoring watches all of it and tells you the day it changes.

Check your domain free → See monitoring