Google Workspace: set up SPF, DKIM and DMARC step by step

Add SPF

At your DNS provider, create a TXT record for the main domain (name @ or empty):

v=spf1 include:_spf.google.com ~all

• If you also send through other services (newsletter tool, shop, CRM), add their include: before the ~all. All services belong in one record.
• ~all marks other servers as suspicious, -all demands rejection. With a DMARC policy, ~all is usually enough.
• If an SPF record already exists, edit it instead of creating a second one. Two records cause a PermError.

Set up DKIM

1. Sign in to the Admin console (admin.google.com) as an administrator.
2. Go to Apps › Google Workspace › Gmail › Authenticate email. Menu names change from time to time.
3. Select your domain. Click Generate new record, choose 2048 bit as the key length and leave the selector as google.
4. Google shows you a TXT record named google._domainkey with a long value that starts with v=DKIM1; k=rsa; p=…. Create it at your DNS provider.
5. Wait until the record can be resolved, then click Start authentication in the Admin console.

With 2048 bits, the value is longer than 255 characters. Many DNS interfaces split it into segments automatically. If yours doesn't and rejects the record, split it yourself into two quoted parts.

Add DMARC

Create a TXT record for _dmarc, for example to start with:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

With p=none, nothing happens to emails yet, but you receive reports on who sends in your name. Later you tighten it to quarantine and reject. The DMARC generator creates the record, and the article Reading DMARC reports explains the next steps.

If you send a lot to Gmail addresses, also set up Google Postmaster Tools. There you see the spam rate of your emails.

Check everything

1. Check the records with the SPF checker, the DKIM checker (selector google) and the DMARC checker.
2. Then send a real email from Gmail to a Postwacht test address. The report shows SPF, DKIM and DMARC from the recipient's point of view.

Typical mistakes

• “Start authentication” doesn't work: the TXT record isn't visible in DNS yet. Wait and try again. Google mentions up to 48 hours, but it usually works much faster.
• Doubled domain name: some DNS interfaces append the domain automatically. Then only enter google._domainkey.
• Wrong domain: if you have several domains or alias domains, you need DKIM for each one.
• Mail through third-party services fails DMARC: newsletter tools need their own DKIM for your domain. Set this up at the service.