SPF for Google Workspace (Gmail)
Add include:_spf.google.com to your domain's single SPF TXT record, never publish two SPF records. If you send only through Google Workspace (Gmail), the whole record is:
v=spf1 include:_spf.google.com ~all
SPF is domain-wide (one TXT record at the root of the sending domain) and is published entirely in your DNS host, NOT in the Google Admin console. Use exactly one SPF TXT record; publishing two makes SPF PermError. The single include:_spf.google.com is all Google needs, it is a nested include that itself expands to _netblocks.google.com, _netblocks2, and _netblocks3 (~4 DNS lookups on its own), so never add raw Google IP ranges. Google recommends ~all (softfail); use -all only once you are certain every legitimate source is listed. If you also send through other services (marketing, CRM, help desk), add their includes to the SAME record, e.g. v=spf1 include:_spf.google.com include:servers.mcsv.net ~all, and watch the 10-lookup limit. Google's guideline: do not exceed 10 DNS lookups (SPF PermError past 10).
DKIM for Google Workspace (Gmail)
DKIM is generated and enabled in the Google Admin console, then published as a TXT record at your DNS host. Steps: (1) Admin console → Apps → Google Workspace → Gmail → Authenticate email. (2) Pick the domain, click Generate New Record. (3) Choose 2048-bit (recommended; use 1024 only if your DNS host caps the string length) and keep the default selector prefix 'google' (change it only if that selector is already in use). (4) Copy the host/name (google._domainkey) and the long p= value. (5) At your DNS host create a TXT record: name = google._domainkey (host appends your domain → google._domainkey.yourdomain.com), value = the whole v=DKIM1; k=rsa; p=... string. (6) CRITICAL: go back to the Admin console and click Start authentication, publishing the DNS record alone does NOT turn DKIM on. Note: after first enabling Gmail you may need to wait up to 24-72h before the key can be generated; and after you click Start it can take up to 48h for DKIM authentication to begin working, that is propagation, ignore the console 'not authenticating' warning once the record is live.
Method: TXT · Selector(s): google
google._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...(2048-bit public key, may be split into two quoted strings)...IDAQAB"
DMARC for Google Workspace (Gmail)
Publish a TXT record at _dmarc.yourdomain.com. Google requires SPF and/or DKIM to be live (and ideally passing) at least 48 hours before enabling DMARC, and Google's own bulk-sender rules require at least p=none plus passing SPF+DKIM with DMARC alignment. Start at p=none with rua reporting, monitor the aggregate reports until Gmail mail shows DKIM alignment, then move to p=quarantine and finally p=reject. DMARC passes when the visible From: domain aligns with the SPF (envelope/return-path) domain OR the DKIM d= domain, with Google Workspace, DKIM d= is your domain so DKIM alignment is the reliable path (SPF alignment breaks on forwarding). Subdomains inherit the org policy unless you set sp=; set sp=reject if you send no subdomain mail. Alignment is relaxed by default (aspf/adkim=r), which is correct for almost everyone.
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; fo=1; adkim=r; aspf=r"
Common Google Workspace (Gmail) mistakes
- Forgetting to click 'Start authentication' in the Admin console after adding the DNS TXT record, the key exists in DNS but Gmail never signs outbound mail, so DKIM silently fails.
- Trying to generate the DKIM key too early: right after turning on Gmail you may have to wait 24-72 hours before the Authenticate email page will produce a key.
- Ignoring the 2048-bit string-length issue, some DNS hosts reject a TXT value longer than 255 chars; you must split the p= value into two quoted strings (or use 1024-bit if the host can't handle it). Do NOT truncate the key.
- Publishing two SPF records (e.g. one from a website builder and one added manually), multiple v=spf1 records = PermError and SPF fails entirely. Merge into one record with multiple include: mechanisms.
- Blowing the 10-DNS-lookup SPF limit by stacking many includes alongside _spf.google.com (which itself costs ~4 lookups); past 10 lookups SPF returns PermError. Flatten or consolidate senders.
- Confusing the record type: Google Workspace DKIM is a TXT record at google._domainkey (not a CNAME like SendGrid/SES). Also entering the full FQDN when the host already appends the domain, producing google._domainkey.example.com.example.com.
- Panicking over the Admin console warning that says DNS isn't updated for up to 48h, that's propagation lag; if the record is correct at the host, it will clear.
- Enabling DMARC p=reject before confirming DKIM alignment passes, causing legitimate Google-sent mail (especially forwarded mail where only DKIM survives) to be rejected.
Frequently asked questions
What SPF record do I need for Google Workspace (Gmail)?
Add include:_spf.google.com to your domain's single SPF TXT record. A domain that sends only through Google Workspace (Gmail) would use: v=spf1 include:_spf.google.com ~all. SPF is domain-wide (one TXT record at the root of the sending domain) and is published entirely in your DNS host, NOT in the Google Admin console. Use exactly one SPF TXT record; publishing two makes SPF PermError. The single include:_spf.google.com is all Google needs, it is a nested include that itself expands to _netblocks.google.com, _netblocks2, and _netblocks3 (~4 DNS lookups on its own), so never add raw Google IP ranges. Google recommends ~all (softfail); use -all only once you are certain every legitimate source is listed. If you also send through other services (marketing, CRM, help desk), add their includes to the SAME record, e.g. v=spf1 include:_spf.google.com include:servers.mcsv.net ~all, and watch the 10-lookup limit. Google's guideline: do not exceed 10 DNS lookups (SPF PermError past 10).
How do I set up DKIM for Google Workspace (Gmail)?
DKIM is generated and enabled in the Google Admin console, then published as a TXT record at your DNS host. Steps: (1) Admin console → Apps → Google Workspace → Gmail → Authenticate email. (2) Pick the domain, click Generate New Record. (3) Choose 2048-bit (recommended; use 1024 only if your DNS host caps the string length) and keep the default selector prefix 'google' (change it only if that selector is already in use). (4) Copy the host/name (google._domainkey) and the long p= value. (5) At your DNS host create a TXT record: name = google._domainkey (host appends your domain → google._domainkey.yourdomain.com), value = the whole v=DKIM1; k=rsa; p=... string. (6) CRITICAL: go back to the Admin console and click Start authentication, publishing the DNS record alone does NOT turn DKIM on. Note: after first enabling Gmail you may need to wait up to 24-72h before the key can be generated; and after you click Start it can take up to 48h for DKIM authentication to begin working, that is propagation, ignore the console 'not authenticating' warning once the record is live.
Do I need DMARC when sending through Google Workspace (Gmail)?
Publish a TXT record at _dmarc.yourdomain.com. Google requires SPF and/or DKIM to be live (and ideally passing) at least 48 hours before enabling DMARC, and Google's own bulk-sender rules require at least p=none plus passing SPF+DKIM with DMARC alignment. Start at p=none with rua reporting, monitor the aggregate reports until Gmail mail shows DKIM alignment, then move to p=quarantine and finally p=reject. DMARC passes when the visible From: domain aligns with the SPF (envelope/return-path) domain OR the DKIM d= domain, with Google Workspace, DKIM d= is your domain so DKIM alignment is the reliable path (SPF alignment breaks on forwarding). Subdomains inherit the org policy unless you set sp=; set sp=reject if you send no subdomain mail. Alignment is relaxed by default (aspf/adkim=r), which is correct for almost everyone.