SPF, DKIM & DMARC for Google Workspace

Google Workspace doesn't host your domain's DNS — you'll add these records wherever your domain is registered or its DNS is managed (Cloudflare, GoDaddy, your registrar's own panel, etc.).

SPF

Add a TXT record at your root domain. If you don't send mail from anywhere else, this is the whole record:

v=spf1 include:_spf.google.com ~all

Already have an SPF record (for a CRM, marketing tool, or anything else)? Don't create a second one — RFC 7208 only allows one SPF record per domain, and having two causes every message to fail. Add include:_spf.google.com inside your existing record instead.

DKIM

Unlike SPF and DMARC, DKIM's value is unique to your account — you can't copy it from a guide. Generate it from Google Workspace itself:

Admin Console → Apps → Google Workspace → Gmail → Authenticate email
Select your domain, click Generate new record
Google gives you a selector (commonly google) and a long TXT value — publish that exact value at google._domainkey.yourdomain.com
Back in the admin console, click Start authentication once the DNS record is live

Google won't actually sign your mail with DKIM until that last step is done, even if the DNS record is published correctly.

DMARC

Not specific to Google Workspace — the same record works everywhere. Use the DMARC record generator to build yours.

Once it's live, check your setup free to confirm everything reads correctly.