All guides

Set up SPF, DKIM and DMARC for Google Workspace

Last reviewed 2026-10-21 · Based on the official references linked below

Set up the three checks that help receiving mail systems recognize email from your business. Start by listing your senders, then update your DNS records and turn on signing in Google Admin.

SPF lists authorized sending services. DKIM adds a signature to outgoing messages. DMARC checks whether SPF or DKIM connects to the domain people see in your From address. These settings do not promise inbox placement.

1. Gather your senders and save your records

You need a Google Workspace super administrator and access to the service that hosts your domain's DNS. That may be different from your domain registrar or website host. Keep sign-ins, passwords and verification codes in your own account.

• List everything that sends as your domain: staff email, invoices, newsletters, website forms and your customer-management tools. Include services you use only occasionally.
• Save your existing DNS records, their values and TTLs (how long DNS answers are cached). Keep an export so you can restore the original settings if needed.
• Preserve working DKIM keys and existing DMARC policies. If you already use quarantine or reject, review that setup rather than replacing it with p=none.

2. Publish one SPF record

At your DNS host, look for a TXT record beginning v=spf1. If one exists, edit it after reconciling all your senders. Do not add a second SPF record for the same domain.

Only if Google Workspace is your sole sending service, Google's SPF value is:

v=spf1 include:_spf.google.com ~all

Use type TXT at the root of your domain. Many hosts call the root @; Wix uses a blank name. Preserve unrelated TXT, MX and website records.

If you use other senders, the example may be incomplete. Check each service's actual sending route and authentication instructions before merging values. SPF has a ten-DNS-lookup limit, including nested lookups; ten visible include entries is not a safe rule.

Reference: Google's SPF setup instructions.

3. Generate, publish and enable DKIM

1. Sign in to Google Admin as a super administrator. Open Apps → Google Workspace → Gmail → Authenticate email, then select your domain.
2. Check for a working configuration first. Squarespace may already have created the DNS key. Preserve a working key.
3. If a key is needed, choose Generate New Record. Select 2048 bits and the selector google. A selector is the name used to find the key. If that name is already in use, choose a different one; use 1024 bits only if your DNS host cannot support 2048.
4. Select Generate. Copy the full DNS Host name (TXT record name) and TXT record value. Leave Start authentication for later.
5. At your DNS host, publish the copied value as a TXT record. The usual relative name is google._domainkey; use the name Google actually gave you. Check that the saved full name does not repeat your domain twice.
6. Return to the same domain in Google Admin and select Start authentication. Look for Authenticating email with DKIM.

Newly activated Gmail may require 24–72 hours before it can generate a key. DNS changes can take up to 48 hours. If a step fails, keep the actual error and recheck; a published key alone does not prove signing is on.

Reference: Google's DKIM setup instructions.

4. Add monitoring DMARC

For a domain starting DMARC, use monitoring mode while you check legitimate senders. Set up a dedicated report mailbox or reporting service first. This example assumes you own example.com and have prepared that mailbox; replace the address with your real report destination before publishing.

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Publish as a TXT record named _dmarc in your domain's DNS zone. Review any existing record and report addresses first. If editing a sending subdomain in its parent zone, include the subdomain in the name: _dmarc.mail for mail.example.com.

p=none does not request blocking for DMARC failures. The rua address requests aggregate reports from participating receivers. For a destination on a different domain, its operator must also authorize reports in that destination domain's DNS. Confirm actual report receipt, too.

References: Google's DMARC setup reference and Google's report and external-destination guidance. Read what p=none means and when to move on.

5. Check a real message and review reports

Send a direct test from your Workspace account to an external Gmail or Workspace recipient. At the receiving account, open More → Show original. Inspect the receiving system's Authentication-Results for spf=pass, dkim=pass and dmarc=pass.

Check alignment as well: DMARC needs either passing SPF with an aligned return-path domain, or passing DKIM with an aligned signing domain. A pass for an unrelated service's domain is not enough. Test your other legitimate sending services separately.

The free checker can inspect public SPF and DMARC records. It cannot test DKIM, sender alignment or nested SPF lookups. Keep reviewing received reports; missing or incomplete reports are a reason to continue monitoring, not to tighten the policy.