DMARC, SPF and DKIM for Google Workspace

Last reviewed 26 October 2026 · Kastro

Domains on Google Workspace need the SPF record v=spf1 include:_spf.google.com ~all, a DKIM key generated in Google Admin and published as a TXT record at google._domainkey, and a DMARC record at _dmarc. Start DMARC at p=none, then move to p=quarantine and finally p=reject.

1. SPF: say who may send

TXTName@Valuev=spf1 include:_spf.google.com ~all

@ means the domain itself. Some DNS hosts want the name field left empty.

If other services also send email as your domain, add them to the same record. A domain may only have one SPF record.

2. DKIM: generate a key in Google Admin

  1. In the Google Admin console: Apps > Google Workspace > Gmail > Authenticate email.
  2. Choose the domain and click “Generate new record”. Pick 2048-bit and keep the prefix google.
  3. Copy the TXT value Google shows (it starts with v=DKIM1) into a new TXT record at google._domainkey.
  4. Wait for the record to propagate, then click “Start authentication” in Google Admin.
TXTNamegoogle._domainkeyValue(the value Google shows, starting with v=DKIM1)

If Gmail was only just turned on, Google may need 24 to 72 hours before the key can be generated, and up to 48 hours before DKIM starts working.

3. DMARC: start in monitoring mode

p=none blocks nothing. It is a safe first stage while you confirm all legitimate mail passes.

TXTName_dmarcValuev=DMARC1; p=none;

4. Tighten DMARC in stages

Send a test email from everything that sends as your domain. When everything arrives normally, change to p=quarantine. After a week or two with no problems, move to p=reject.

TXTName_dmarcValuev=DMARC1; p=quarantine;
TXTName_dmarcValuev=DMARC1; p=reject;

Common questions

What SPF record does Google Workspace use?

v=spf1 include:_spf.google.com ~all. If other services also send email as your domain, add them to the same record instead of creating a second one.

How do I check DKIM is working?

Send an email to someone else's Gmail address (not your own) and look at Authentication-Results in the headers. It should say dkim=pass.

Why isn't DKIM working yet?

DNS changes can take up to 48 hours. Also remember to click “Start authentication” in Google Admin after the record is published.

Sources