Short answer: For SPF, add the TXT record v=spf1 include:_spf.google.com ~all. For DKIM, generate a key under Admin console → Apps → Google Workspace → Gmail → Authenticate email, publish it as the google._domainkey TXT record, and click Start authentication. Finally, turn on DMARC with a _dmarc TXT record.
Google Workspace SPF record
| Type | Host / Name | Value |
|---|---|---|
| TXT | @ | v=spf1 include:_spf.google.com ~all |
If anything besides Google sends mail for your domain (a website form, your hosting server, a newsletter tool), add it to the same record. For example, if your own server also sends: v=spf1 ip4:SERVER_IP include:_spf.google.com ~all. Don't add a second v=spf1 record. To build the line, use the SPF record generator.
Google Workspace DKIM setup
- Sign in to admin.google.com with an administrator account.
- Open Apps → Google Workspace → Gmail → Authenticate email.
- Select your domain and click Generate new record. Choose a 2048-bit key (use 1024 only if your DNS host can't handle long TXT records).
- Add the record shown on screen to your DNS:
| Type | Host / Name | Value |
|---|---|---|
| TXT | google._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkq... (value from the Admin console) |
- Once the DNS record has propagated, return to the Admin console and click Start authentication. If the record isn't visible yet you'll get an error; wait and try again (Google allows up to 48 hours for propagation).
After adding the record, verify it with our SPF, DKIM, DMARC checker; it tries the google selector automatically.
MX record and spam filtering
Domains newly set up on Google Workspace usually have a single MX record: smtp.google.com (priority 1). Older setups use aspmx.l.google.com and its backups; both are valid. You can confirm with the MX record lookup.
Gmail's built-in filtering is strong, but if you need a central quarantine across all mailboxes, company-wide rules, or an independent second layer, you can put an email security gateway in front of Google Workspace. The MX then points to the gateway, and the gateway's IPs are added in Google Workspace as an inbound gateway.
DMARC record for Google Workspace
DMARC is added directly in DNS, independent of your mail provider. Once SPF and DKIM work, start with this record:
| Type | Host / Name | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
p=nonefor 1-2 weeks: the aggregate reports show every source sending mail as your domain. If anything besides Google Workspace sends for you (invoicing, CRM, newsletter tool), add it to SPF/DKIM too.p=quarantine: mail that fails authentication goes to the recipient's spam folder.p=reject: mail that fails is refused outright. This is the strongest protection against spoofing of your domain.
Use a dedicated mailbox for the report address (rua); reports are XML files and arrive frequently. Gmail, Yahoo and Microsoft all require at least p=none from bulk senders.
How to verify the setup
- Enter your domain in the SPF, DKIM, DMARC checker and make sure all three records show green.
- Send a test message to a Gmail address, open it and choose ⋮ → Show original. You should see
PASSfor SPF, DKIM and DMARC. - Paste the headers into the email header analyzer to read the details in a friendly format.
Protect your inbox from spam, malware and phishing: point your MX record to Spambil and try it free for 7 days. No credit card required.
Frequently asked questions
Why do I have to click 'Start authentication' for Google Workspace DKIM?
Google only starts signing after it sees the record in DNS and you enable it. Without that step, outgoing mail isn't signed with your domain even if the record exists.
Should I use ~all or -all in SPF?
Use -all if you're sure every sending source is included. If not, start with ~all and watch your DMARC reports.