Google Workspace email authentication setup
Steps to publish SPF, enable DKIM and roll out DMARC for a domain sending through Google Workspace (the product formerly called G Suite). These are DNS changes at your domain registrar or DNS host — not inside the Google Admin console — except where noted.
1. SPF
Add (or edit, if one already exists — a domain can only have one SPF record) a TXT record at your domain's apex:
| Host | Type | Value |
|---|---|---|
@ (or your domain itself) | TXT | v=spf1 include:_spf.google.com -all |
If you also send through other services (a CRM, invoicing platform, marketing tool, your
website's contact form), each needs its own include: added to the same
record — never publish two separate SPF TXT records. Use the
SPF generator to combine multiple
providers correctly, and start with ~all instead of -all while
you confirm every legitimate sender is covered.
2. DKIM
- In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
- Select the domain and click Generate new record. Google shows a TXT record with a selector like
google._domainkey. - Publish that TXT record at your DNS host exactly as shown.
- Back in the Admin console, click Start authentication for the domain — DNS propagation can take a few hours before this succeeds.
3. DMARC
Once SPF is published and DKIM is authenticating, add a DMARC TXT record:
| Host | Type | Value |
|---|---|---|
_dmarc | TXT | v=DMARC1; p=none; rua=mailto:[email protected] |
Start at p=none and read the aggregate reports it generates before moving to
quarantine then reject — see
DMARC and
DMARC reports for why, and the
DMARC generator to build the record.
Common Google Workspace pitfalls
- Publishing a second SPF TXT record instead of editing the existing one — only one is valid; a second silently breaks SPF.
- Leaving DKIM at "Generate new record" without clicking "Start authentication" — the TXT record can be published but signing never actually turns on.
- Forgetting a third-party sender (a CRM, form, or marketing tool) that also sends "from" your domain — it needs its own SPF include and ideally its own DKIM selector before you enforce DMARC.
Run a free check after each step to confirm it's live.