Skip to content
inboxprobe

Checkers

Generators

Guides

Guides

SPF, DKIM and DMARC for Google Workspace

The three records Google Workspace needs, exactly as Google documents them, in the order to add them. Check your domain at any point.

1. SPF

Google Workspace only

Type
TXT
Host / name
@
Value
v=spf1 include:_spf.google.com ~all

If other services send as your domain, add their includes to the same record — for example v=spf1 include:_spf.google.com include:sendgrid.net ~all. Google's include costs 4 of your 10 DNS lookups at the time of writing. The SPF generator builds and counts the combined record.

2. DKIM

  1. Sign in to the Google Admin console as a super admin. If you just turned on Gmail, Google says to wait 24–72 hours before generating a key.
  2. Go to Apps → Google Workspace → Gmail → Authenticate email.
  3. Select your domain and Generate new record. Keep the 2048-bit key length and the default prefix selector google.
  4. Copy the TXT record value and publish it at host google._domainkey.
  5. Select Start authentication. The Admin console can keep saying the DNS records need updating for up to 48 hours; if your record is published correctly, that message can be ignored.
Type
TXT
Host / name
google._domainkey
Value
v=DKIM1; k=rsa; p=<the long key from the Admin console>

Until you complete this step, Gmail signs with a default Google domain instead of yours. That signature doesn't align with your domain, so DMARC relies on SPF alone — and fails when mail is forwarded.

3. DMARC

Start here

Type
TXT
Host / name
_dmarc
Value
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Google recommends starting with p=none and a report address, then moving to quarantine and reject as reports confirm everything passes. Use the DMARC generator for each stage.

MX, for completeness

New Google Workspace setups use a single MX record, smtp.google.com with priority 1. Older setups with the five aspmx.l.google.com hosts keep working and don't need changing.

Questions

Why does my Google Workspace mail fail DMARC?

Most often because DKIM hasn't been started in the Admin console, so Gmail signs with a Google default domain that doesn't align with yours, or because another service sends as your domain without its own SPF/DKIM.

My DNS host won't accept the long DKIM key.

Some panels limit TXT values to 255 characters. Try pasting the whole key — many split it automatically. Otherwise split it into several quoted strings, or generate a 1024-bit key as a last resort.

Should I use ~all or -all with Google Workspace?

Google's documentation uses ~all. With DMARC enforcing, ~all is the common choice.

Can I change the DKIM selector from google?

Yes, Google lets you set a different prefix, which is useful when rotating keys or with multiple domains. Enter the custom selector in our DKIM checker to verify it.

Sources

Last reviewed: