Google Workspace: set up SPF, DKIM and DMARC

To authenticate mail sent through Google Workspace (Gmail), publish three DNS records: an SPF record, a DKIM key on the google selector (generated in the Admin console, published at google._domainkey), and a DMARC record at _dmarc. SPF and DKIM prove the mail is really from you; DMARC ties both to your From domain.

Do all three. SPF alone is not enough for Gmail-to-Gmail or for the authentication gates Microsoft and Google now enforce on bulk senders — DKIM is what survives forwarding, and DMARC is what makes the pass count.

Step 1 — SPF

Add a single TXT record at your root domain (host @):

You may publish only one SPF record per domain, and it must resolve within 10 DNS lookups. If you also send through another service (an ESP, a helpdesk, a CRM), merge every source into this one record — do not add a second v=spf1 line. As of mid-2026, include:_spf.google.com costs just one lookup — Google now publishes its address ranges directly inside it rather than through nested includes. Other services' includes still nest and count recursively, so watch the budget: paste your record or domain into the SPF lookup counter to see the count and the offending mechanism before you publish.

Google's official instructions: Prevent spoofing and spam with SPF.

Step 2 — DKIM

Google does not hand you a DKIM key until you generate one. In the Admin console → Apps → Google Workspace → Gmail → Authenticate email, pick your domain and generate a 2048-bit key. Google then shows you two values:

• a DNS host name — google._domainkey
• a TXT value beginning v=DKIM1; k=rsa; p=...

Publish that as a TXT record, wait for it to propagate, then return to the same screen and click Start authentication. The default selector is google; leave it unless you have a reason to change it.

Google's official instructions: Turn on DKIM for your domain.

Step 3 — DMARC

Once SPF and DKIM both pass, publish a DMARC record as a TXT record at host _dmarc:

Start at p=none — it enforces nothing but sends you the aggregate reports (rua) that show which of your sending sources are aligned. Read those reports, fix anything that fails, and only then move up to p=quarantine and eventually p=reject. Never jump straight to reject: a premature policy silently drops legitimate mail.

Paste your record into the DMARC record checker to validate the tags and preview a safe next step. Google's official instructions: Add a DMARC record.

Where to add these records

All three go in your domain's DNS zone, wherever your nameservers live — that is usually your registrar or DNS host, not Google:

• Cloudflare — DNS → Records → Add record (TXT). Set the DKIM/DMARC host to google._domainkey / _dmarc; use @ for the root SPF record.
• GoDaddy / Namecheap / Squarespace / Route 53 — the DNS or "Advanced DNS" panel. Enter only the host prefix your DNS panel shows (e.g. google._domainkey) — most panels append your domain automatically.

TXT values can be long; paste them exactly, with no added quotes or line breaks. DNS changes can take a few hours to propagate before Google can verify them.

Verify it worked

Send a test message to a mailbox you control, open the raw headers, and confirm spf=pass, dkim=pass, and dmarc=pass. To see SPF lookups, DKIM presence, and DMARC alignment in one place, run a scan of your domain below.