// GUIDE

SPF, DKIM and DMARC in Google Workspace

With Google Workspace, SPF is an include: and the DKIM key is generated in the Admin console: you publish it in your DNS and then press “Start authentication”. Without that last step, Gmail does not sign with your domain.

What to publish

SPF TXT @ (the domain)

v=spf1 include:_spf.google.com ~all

The one Google recommends. If you send from more services, add their include: in the same record (one SPF record and at most 10 DNS lookups).

DKIM TXT google._domainkey

The key the console generates (v=DKIM1; k=rsa; p=…).

google is the default selector. A 2048-bit key; 1024 only if your DNS provider does not allow long TXT records.

DMARC TXT _dmarc

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start at p=none with reports and move to quarantine and reject once all your legitimate mail passes (below).

Step by step

Publish the SPF record at your DNS provider (or add include:_spf.google.com to the one you have).
In the Admin console (admin.google.com): Menu > Apps > Google Workspace > Gmail > Authenticate email.
Pick your domain, generate a new record (2048 bits, prefix google) and publish the TXT record at google._domainkey.
Go back to the same page and press “Start authentication”. DKIM can take up to 48 hours to start working.
Publish DMARC at p=none with an rua mailbox and read the reports for a few weeks before raising the policy.

Usual mistakes

Forgetting “Start authentication”: publishing the TXT record is not enough.
A DNS provider that truncates long TXT records: the 2048-bit key is split into several strings; if your panel cannot do it, generate a 1024-bit one.
Two SPF records (for example, your old hosting’s and Google’s): merge them into one.
Removing your hosting’s include: without checking whether it still sends mail on your behalf (website forms, invoices…).

Towards p=reject

DMARC at p=none only watches. The reports (rua) show who sends on your behalf; once all your legitimate mail passes aligned SPF or DKIM, move to quarantine and then to reject. That way, nobody can use your domain to send forged mail.

Check your domain

Sources

Checked on 24 September 2026. Panels change: if something does not match, the provider’s documentation wins.