How to Set Up DMARC, DKIM & SPF for Google Workspace

Google Workspace (formerly G Suite) includes built-in support for SPF, DKIM, and DMARC. This guide walks through configuring all three for your Google Workspace domain.

SPF for Google Workspace

Create Your SPF Record

Add this TXT record to your domain's root (@):

v=spf1 include:_spf.google.com ~all

If you have other sending services, combine them:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Adding the DNS Record

1. Go to your DNS provider's management console
2. Add a new TXT record
3. Host/Name: @ (or blank for root domain)
4. Value: Your SPF record
5. TTL: 3600 or default

DKIM for Google Workspace

Generate DKIM Key

1. Go to Google Admin Console (admin.google.com)
2. Navigate to Apps → Google Workspace → Gmail
3. Click "Authenticate email"
4. Select your domain
5. Click "Generate new record"
6. Select DKIM key bit length (2048 recommended)
7. Prefix selector (default "google" is fine)

Add DKIM DNS Record

1. Copy the provided DNS hostname and TXT record value
2. In your DNS provider, add a new TXT record
3. Host/Name: google._domainkey (or the prefix you chose)
4. Value: The provided DKIM key (starts with v=DKIM1)
5. Wait for DNS propagation (up to 48 hours)

Start DKIM Signing

1. Return to Google Admin → Gmail → Authenticate email
2. Click "Start authentication" for your domain
3. Status should change to "Authenticating email"

DMARC for Google Workspace

Create DMARC Record

Add this TXT record at _dmarc.yourdomain.com:

Start with: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Adding the DNS Record

1. Add a new TXT record
2. Host/Name: _dmarc
3. Value: Your DMARC record
4. TTL: 3600 or default

Verification

Test Your Setup

1. Send an email from your Google Workspace account to a Gmail account
2. Open the received email
3. Click three dots → "Show original"
4. Look for:
   • spf=pass
   • dkim=pass
   • dmarc=pass

Use Google's Postmaster Tools

Set up Google Postmaster Tools to monitor your domain's reputation and authentication status with Gmail.

Common Issues

DKIM Shows "Not Started"

• Verify DNS record is correct
• Wait for full DNS propagation
• Click "Start authentication" in Admin Console

Multiple Domains

Each domain in Google Workspace needs its own SPF, DKIM, and DMARC records. Repeat the process for each domain.

Subdomains

DKIM must be configured for each subdomain that sends email. SPF and DMARC can use subdomain policies.

For complete authentication guidance, see our Email Authentication Complete Guide.