Google Workspace SPF/DKIM/DMARC setup

These three Google help pages were read on 2026-10-15. The console labels move. The record values below are the part to check against the live page before you paste.

The host-agnostic order is How to set up DMARC. Microsoft 365 uses CNAME records and the Defender portal, which is a different note.

1. SPF, at the domain host

Google's SPF page says you do nothing in the Admin console. If you only send through Google Workspace, the record they tell you to copy is v=spf1 include:_spf.google.com ~all. They recommend ~all, which asks receivers to treat unlisted servers as suspicious rather than to refuse them. When every sender you care about passes, you can change that tag to -all. Do not publish +all.

The same page has a table of includes for a few other products, including Amazon SES, Mailchimp, Microsoft 365, Salesforce, Shopify, and Zendesk. Treat that table as a hint and confirm the include on the sender's own page the day you edit DNS. Vendors change them. Add the include to the one Google record. A second SPF TXT record is a permanent error under RFC 7208.

Google's page also says an SPF record can have up to 10 include tags. The spec limit is 10 DNS lookups, and a lookup inside an include counts (RFC 7208 section 4.6.4). Ten includes can already be over the cap. Drop anything you no longer send from.

If you bought the domain from a Google partner when you signed up, their page says SPF may already be present. Read the current TXT record before you add another.

2. DKIM, generated in the Admin console

You need a super administrator. Google's DKIM page says to wait 24 to 72 hours after Gmail is turned on before you generate a key. Earlier than that, the console can say the DKIM record was not created.

In the Admin console: Menu, Apps, Google Workspace, Gmail, Authenticate email. Pick the domain. Generate new record. Choose 2048 bits if the DNS host accepts a TXT value that long. Otherwise 1024. The prefix they recommend is google, unless that name is already in use. Generate, then copy the host name and the TXT value. The host looks like google._domainkey. The value starts with v=DKIM1; k=rsa; p=. Paste what the console shows. Do not click Start authentication yet. Their page says so.

Add that TXT record at the domain host. Some DNS hosts limit how long a TXT value may be. Google links a note about that on the same page. If the domain is on Squarespace, their page says the key may already have been created and published, and you can skip to turning authentication on.

After the TXT record is in DNS, go back and start authentication. They say the console can keep showing "You must update the DNS records for this domain" for up to 48 hours even after the record is correct. Check the record at the DNS host before you generate a second key. Send a new message. The d= value in DKIM-Signature has to be your domain. Each extra Workspace domain needs its own key from the console.

An outbound gateway that adds a footer can break the signature. Their page points at the outgoing-gateway setting for that case. If you use one, read that note before you blame DNS.

3. DMARC, also at the domain host

Google's DMARC page says there is nothing to turn on in the Admin console. They also say to allow 48 hours after SPF and DKIM before you add DMARC, and that mail will probably have delivery problems if you publish DMARC with neither in place.

Create a group or a dedicated mailbox for the reports. They say a large sender can get hundreds or thousands of reports a day. That is a volume warning, not a count of attacks. Put that address in rua. Gmail does not support ruf. An address on a different domain needs an authorization record. Their page says so, and RFC 7489 section 7.1 is the rule.

One TXT record:

Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@company.com

Their worked example on the same page is v=DMARC1; p=reject; rua=mailto:postmaster@example.com, mailto:dmarc@example.com; pct=100; adkim=s; aspf=s. Do not paste that on the first day. The prose above the example says to start at p=none, then move to quarantine or reject. adkim=s and aspf=s are strict alignment. The default, with those tags omitted, allows a subdomain to align. Strict mode is a later choice. pct defaults to 100 if you leave it out. They suggest including it only when you want to apply a tighter policy to a fraction of mail first.

Third-party mail has to pass too. Their page tells you to make the provider's envelope domain match yours, to add the provider to SPF, or to relay that mail through Google. A tool that signs as itself will pass DKIM for the tool and still fail DMARC for you.

What Gmail asks of senders

Email sender guidelines say that, starting 1 February 2024, anyone sending to Gmail accounts needs SPF or DKIM. Senders of more than 5,000 messages a day to Gmail accounts need SPF and DKIM, and DMARC. That page says the DMARC policy can be none. A company under that volume should still publish the record. The guideline is a floor for bulk mail.

See the records, or have them published

/check looks up MX, SPF, DMARC, and the selector google among five common DKIM names. It does not store the domain and it does not read Workspace reports. A custom selector will not appear. The name in the Admin console is the one that has to exist.

The $9 report writes that live lookup into a PDF, with a step for each unfinished row. Download requires a license key from the purchase. If checkout is not connected, the page says Coming soon.

DMARC setup is DME Computer Services in Omaha doing the audit, the records, and 30 days of aggregate-report reading. $199 is one Google or Microsoft domain. $499 is three domains or extra senders. It does not start at p=reject unless the reports are already clean. Contact info@dmeomaha.com.