SPF, DKIM, and DMARC Setup for Google Workspace

SPF, DKIM, and DMARC are email authentication controls. They do not replace good mailbox security, and they do not guarantee that every message lands in the inbox. They help receiving mail systems decide whether a message that claims to come from your domain is allowed, signed, and aligned with your domain policy.

For a small business using Google Workspace, the goal is practical: reduce spoofing risk, improve trust, and avoid breaking legitimate mail from websites, CRMs, invoicing systems, payment reminders, support tools, and marketing platforms.

Quick answer

For a Google Workspace-only sender setup, the starting SPF policy often looks like this:

v=spf1 include:_spf.google.com ~all

But do not blindly paste that if your domain also sends from a website, CRM, help desk, billing tool, marketing system, or SMTP relay. SPF is usually one TXT record for the domain, and it should include all legitimate senders. Google's SPF documentation explains the Google include pattern and the need to identify senders first: Set up SPF.

The safe order is:

Sender inventory

Most SPF and DMARC mistakes happen because the team only thinks about Gmail. A domain can send from many places:

If an approved system sends from @company.com, record its SPF include value, DKIM requirement, bounce address behavior, and whether it supports custom return-path alignment. This is the difference between a real authentication setup and a DNS record copied from a checklist.

Set up SPF

SPF answers a sender authorization question: is this sending server allowed by the domain's SPF policy?

The implementation rules:

• Keep one SPF TXT record for the root domain.
• Include Google Workspace with include:_spf.google.com when Google sends mail for the domain.
• Add only legitimate third-party senders.
• Keep all as the final mechanism.
• Avoid duplicate SPF TXT records.
• Avoid adding providers that no longer send mail.

Google's SPF troubleshooting guidance also highlights common checks: record existence, syntax, third-party senders, DNS management, lookup limits, and waiting for DNS fixes to take effect. See Troubleshoot SPF issues.

Set up DKIM

DKIM adds a digital signature to outbound mail. For Google Workspace, the practical flow is:

1. Open Google Admin.
2. Go to Gmail authentication settings.
3. Select the domain.
4. Generate a DKIM key.
5. Add the provided TXT record at the active DNS host.
6. Wait until DNS is visible.
7. Return to Google Admin and start authentication.
8. Send a test email and inspect headers.

Use Google's current DKIM setup instructions while implementing: Set up DKIM.

DKIM can fail even when the DNS record exists. Common causes include copying the key incorrectly, placing the selector under the wrong host, publishing at the wrong DNS provider, using an old key after regeneration, or sending through a third-party system that does not sign with your domain.

Set up DMARC

DMARC tells receivers how to handle mail that fails authentication and alignment checks. It also enables aggregate reporting when configured with a reporting address.

For small-business Google Workspace rollouts, do not start by rejecting everything. Start with visibility:

v=DMARC1; p=none; rua=mailto:[email protected]

Use a real mailbox or reporting tool that someone will review. A DMARC record that sends reports to a mailbox nobody reads is not operational monitoring.

Google recommends setting up SPF and/or DKIM before DMARC and rolling DMARC out gradually. Use Google's current DMARC instructions and recommended rollout guidance while implementing: Set up DMARC and Recommended DMARC rollout.

Troubleshooting and monitoring

Authentication troubleshooting needs evidence. Send test messages to an external mailbox, open the message headers, and look for SPF, DKIM, and DMARC results. Google's DMARC troubleshooting guide specifically points to checking message headers for authentication results: Troubleshoot DMARC issues.

FAQ