How to set up SPF, DKIM & DMARC for Google Workspace

Google Workspace sends your day-to-day mail, so its authentication is the foundation everything else sits on. Both records take about ten minutes; DKIM requires one trip to the Admin Console because Google generates the key.

SPF

One TXT record at the root of your domain authorizes Google's servers. If other services also send as your domain, their include: mechanisms go in this same record — a domain gets exactly one SPF record.

Type	`TXT`
Host / Name	`@` @ means the root of the domain. If your provider rejects @, enter the bare domain or leave the Host field empty.
Value / Content	`v=spf1 include:_spf.google.com ~all`

DKIM

Google generates a signing key unique to your account, so the record value comes from the Admin Console — choose 2048-bit unless your DNS host can't store long TXT values.

Type	`TXT`
Host / Name	`google._domainkey`
Value / Content	`v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A…` Example only — generate it at Admin Console → Apps → Google Workspace → Gmail → Authenticate email, then copy the full value shown there.

Sign in to admin.google.com → Apps → Google Workspace → Gmail → Authenticate email.
Select your domain, click Generate new record, choose 2048-bit.
Publish the TXT record it shows, wait for DNS, then click Start authentication.
Verify with our DKIM checker — the selector is google.

DMARC

DMARC is per-domain, not per-provider — one record at _dmarc.yourdomain.com covers Google Workspace and everything else that sends as you. Start in monitor-only mode:

Type	`TXT`
Host / Name	`_dmarc` Some providers want the full _dmarc.yourdomain.com here.
Value / Content	`v=DMARC1; p=none; rua=mailto:your-report-address` Example only — replace your-report-address — our DMARC generator builds the record, or sign up free and we generate it with a report address that feeds your monitoring dashboard.

Provider note: Google Workspace signs with your own domain, so both SPF and DKIM align automatically — no extra alignment work needed.

Full walkthrough: how to set up DMARC without breaking your email, and why aligned authentication is what DMARC actually checks.

Verify it worked

After DNS propagates (minutes to an hour), send a message from Google Workspace to our inbox test — it shows the real SPF/DKIM/DMARC verdicts a receiver computes, including whether authentication aligned with your domain. Then HealthCheck Email keeps checking daily and alerts you when a record breaks.

Records current as of 2026-07-13. Provider dashboards change — the authoritative reference is Google Workspace's official docs.