SPF, DKIM and DMARC for Google Workspace: step-by-step setup

1. SPF

You set the record at your domain's DNS provider (registrar, hosting, Cloudflare), not in the Google console. Type TXT, host @ for the root domain:

v=spf1 include:_spf.google.com ~all

If another service also sends mail with your domain, add it to the same record, for example v=spf1 include:_spf.google.com include:amazonses.com ~all. A domain may have only one SPF record. Google recommends the ~all ending; once you are sure the sender list is complete, you can move to -all.

2. DKIM

1. In the Admin console open Apps, Google Workspace, Gmail, Authenticate email. You need super administrator privileges.
2. Select the domain and click Generate new record. Choose a key length of 2048 bits and leave the selector prefix at its default: google.
3. At your DNS provider add a TXT record named google._domainkey with the value copied from the console (it starts with v=DKIM1; k=rsa; p=).
4. Only after adding the record go back to the console and click Start authentication. The status should change to authenticating email with DKIM.

Pitfalls described by Google:

• A 2048-bit key is longer than 255 characters, which is the limit for a single string in a TXT record. If your DNS panel rejects the value, split it into several quoted strings entered one after another, or generate a 1024-bit key.
• Right after turning on Gmail for a domain, generating the key may fail; Google says you need to wait 24-72 hours.
• The message about needing to update DNS can hang around for up to 48 hours after you add a correct record.
• A message sent to yourself will not show whether DKIM works. Send it to another Gmail account and check DKIM=pass in the message's original.

3. DMARC

You do not turn anything on in the Google console. At your DNS provider add a TXT record named _dmarc:

v=DMARC1; p=none; rua=mailto:[email protected]

Google recommends starting with p=none and waiting 48 hours after SPF and DKIM are configured. Some DNS panels append the domain name to the host field on their own; after saving, check that the record is not called _dmarc.yourcompany.com.yourcompany.com. Gmail does not send detailed reports (ruf), only aggregate ones (rua). The next rollout steps are described in the DMARC guide.

Check the result

After the changes, check the records with the SPF checker and the DMARC checker, or run the full domain audit below. The full audit recognizes Google Workspace by the MX records and looks for a DKIM key under the google selector.

Source: Google Workspace documentation (SPF, DKIM and DMARC setup, pages updated in October 2026): DKIM, SPF, DMARC. Menu item names may change.