Skip to main content
Relaymetry

How to set up SPF, DKIM, and DMARC for Google Workspace

A domain on Google Workspace needs four DNS records: an SPF TXT record (v=spf1 include:_spf.google.com ~all), a DKIM key you generate in the Admin console and publish at google._domainkey, a DMARC policy at _dmarc, and Google’s single MX record (smtp.google.com). The exact steps are below.

To authenticate mail from your domain on Google Workspace you publish four DNS records: an SPF TXT record naming Google as a sender, a DKIM key that Google generates for you in the Admin console, a DMARC policy, and Google's MX record for inbound mail. The values below are the stable ones; always confirm the exact steps against Google's current setup guide, because the Admin console layout changes.

SPF

Publish one TXT record at your domain's root (host @):

v=spf1 include:_spf.google.com ~all

include:_spf.google.com authorizes Google's sending servers. If you also send through another service — a marketing platform, a help desk — add its include: before the ~all, in the same single record. A domain may publish only one SPF record; a second v=spf1 record is a misconfiguration that causes a PermError. Check the result with the SPF checker.

DKIM

Google generates the key for you, so DKIM is a two-step job — create the key in the console, then publish it in DNS:

  1. In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
  2. Select your domain and Generate new record. Keep the default 2048-bit key and the google selector unless you have a reason to change them.
  3. Google shows a TXT record. The host is google._domainkey and the value begins v=DKIM1; k=rsa; p=…. Publish that TXT record in your DNS. A 2048-bit key is long, and some DNS panels split the value into quoted chunks automatically.
  4. Return to the console and Start authentication. Google verifies the record and begins signing outgoing mail.

Confirm the published key with the DKIM checker using the selector google. A dkim=none result after you publish usually means signing has not been turned on yet in step 4, or DNS has not propagated.

DMARC

Once SPF and DKIM are in place, publish a DMARC policy as a TXT record at host _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start at p=none, which only monitors and sends you aggregate reports at the rua address. Read the reports until you are confident every legitimate source is aligned, then raise the policy to p=quarantine and finally p=reject. Moving straight to p=reject risks blocking a legitimate sender you did not know about. Read your current record with the DMARC checker.

MX

Google now uses a single MX record. At your domain's root, publish:

Host: @   Priority: 1   Value: smtp.google.com

Older Google Workspace setups used five ASPMX records; the single smtp.google.com record is the current recommendation and either will deliver. Check yours with the MX lookup. If you are moving from another provider, only change MX once mailboxes are ready on Google, because MX controls where all inbound mail goes.

Check your work

DNS changes can take up to a day to propagate. After you publish, run a check from the Relaymetry home page to read all four records at once and confirm SPF, DKIM, and DMARC pass. For the mechanics behind these records rather than the Google-specific steps, see email authentication explained, and to set the same records up at a different mailbox provider, start from the setup hub.

Frequently asked questions

What is the SPF record for Google Workspace?

Publish one TXT record at your domain root: v=spf1 include:_spf.google.com ~all. The include authorizes Google to send for your domain. If you send through other services too, add their includes to the same record before ~all — a domain may have only one SPF record.

How do I enable DKIM in Google Workspace?

In the Admin console go to Apps → Google Workspace → Gmail → Authenticate email, select your domain, and Generate new record (2048-bit, selector google). Publish the shown TXT record at google._domainkey in your DNS, then return and Start authentication so Google begins signing.

What are the Google Workspace MX records?

Google now uses a single MX record: host @, priority 1, value smtp.google.com. Older setups used five ASPMX records; either delivers, but the single smtp.google.com record is the current recommendation.

Why is DKIM still failing after I added the record?

The most common cause is that signing was never turned on — publishing the TXT record is only half the job; you must return to the Admin console and click Start authentication. The other common cause is DNS propagation, which can take up to a day. Re-check with the selector google before changing anything.

What DMARC policy should I start with?

Start with v=DMARC1; p=none; rua=mailto:you@yourdomain.com at _dmarc. p=none only monitors and sends you reports. Once the reports show every legitimate sender aligned, raise the policy to quarantine and then reject. Jumping straight to reject risks blocking mail you did not know about.

Other providers

References

Browse all guides →