Set up SPF, DKIM and DMARC on Google Workspace

If your business uses Google Workspace (business Gmail), here is how to enable the three anti-spoofing protections.

1. SPF — allow Google's servers

Add a TXT record on your domain:

v=spf1 include:_spf.google.com ~all

For stricter protection, switch to -all once all your sending services are listed.

2. DKIM — sign your emails

In the Google Admin console (admin.google.com) → Apps → Google Workspace → Gmail → Authenticate email. Click "Generate new record", add the provided TXT on google._domainkey to your DNS, then click "Start authentication".

3. DMARC — block spoofers

Add a TXT on _dmarc.yourdomain.com, starting gently:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Monitor, then move to p=quarantine and finally p=reject.

Traps specific to Google Workspace

1. The default DKIM key is weak. Google still offers a 1024-bit key on some accounts: pick 2048 bits when generating it. Same effort, and it is what modern checkers expect.
2. Forgetting “Start authentication”. Publishing the TXT record is not enough: until you click Start authentication in the console, Gmail signs nothing.
3. The selector is not always google. You can customize it, and many test tools only look for common names — hence meaningless “DKIM not detected” results. Our report accepts a hand-typed selector to settle the question.
4. Send-as aliases. If your staff send from Gmail using an address on another domain, that domain needs its own SPF, DKIM and DMARC — otherwise those emails fail authentication at the recipient.
5. Leaving ~all in place. Google suggests starting soft; once your sending services are listed, move to -all. A permissive SPF weakens everything else.

Checking that it is really on

Allow minutes to hours for DNS propagation, then run our free report: it reads your public records and tells you which DKIM selector is actually published. For proof on the receiving side, email yourself and paste the header into our header analyzer. Finally, turn on free monitoring so you are warned if one of those records ever disappears — the kind of regression nobody notices until email starts failing.