Guides · Updated 2026-10-11

DMARC, SPF and DKIM for Google Workspace: step by step

1. SPF

Add (or edit your single) TXT record at your root domain:

v=spf1 include:_spf.google.com ~all

If other services send as you, add their includes to the same record.

2. DKIM

In the Google Admin console, go to Apps > Google Workspace > Gmail > Authenticate email.
Select your domain and click Generate new record. Choose a 2048-bit key if your DNS host supports it. The default selector is google.
Publish the TXT record at google._domainkey.yourdomain.com with the value shown.
Wait for DNS to update, then click Start authentication.

Until you do this, Google signs with a default domain that does not align with yours, so DKIM won't help DMARC.

3. DMARC

Add a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:[email protected]

Watch reports for a few weeks, confirm all senders pass, then move to p=quarantine and p=reject. See the rollout guide.

Check your domain now. Our free checker grades DMARC, SPF, DKIM, MX, BIMI and MTA-STS in seconds.

Sources

This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.