How to set up SPF, DKIM and DMARC for Google Workspace

How do I set up DMARC for Google Workspace?

Work through these steps in order:

1. Publish one SPF record. Add a TXT record at your domain root, v=spf1 include:_spf.google.com ~all, merged with any senders you already list.
2. Turn on DKIM. In the Google Admin console, generate a 2048-bit key, publish it as a TXT record at google._domainkey, then click Start authentication.
3. Wait 48 hours. Google advises letting SPF and DKIM authenticate your mail for at least 48 hours before you add DMARC.
4. Publish a DMARC record. Add a TXT record at _dmarc such as v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com, with your own reporting address. p=none means monitoring only.
5. Read the reports, then enforce. Fix each sender that fails in your DMARC reports, then move to p=quarantine (send fakes to spam). Move to p=reject (refuse fakes) once each sender also signs with aligned DKIM.

Only DKIM needs the Admin console, where you must sign in as a super administrator. SPF and DMARC are TXT records you add at your DNS host.

Step 1: publish one SPF record

If Google Workspace is your only sender, Google's Set up SPF page gives this record for the root of your domain (often @ in DNS panels):

Type:  TXT
Host:  @
Value: v=spf1 include:_spf.google.com ~all

Google recommends ~all (soft fail), which suits a domain that publishes DMARC; SPF hard fail vs soft fail explains why. What is SPF? covers how the record works.

If the domain already has an SPF record, add Google's include to it rather than publishing a second one: with two, SPF returns a permanent error and none of your mail passes SPF (RFC 7208, section 4.5). To combine Google with other senders, such as Microsoft 365 or a marketing platform, build the one record with the free SPF Record Generator, which has presets for both and counts the lookups.

Google's include costs 1 of the 10 DNS lookups SPF allows (RFC 7208, section 4.6.4): on 9 October 2026, _spf.google.com listed Google's address ranges directly. If adding it takes your record past 10, the SPF Flattener page shows how to fix too many DNS lookups.

Google adds that each domain needs its own SPF record, and so does each subdomain you use. SPF can take up to 48 hours to start working.

Step 2: turn on DKIM in the Google Admin console

DKIM adds a signature to each message, which receivers check against the public key you publish in DNS. Gmail's forwarding guidance says forwarded messages often fail SPF, which is why Google recommends DKIM alongside it. The steps below follow Google's Set up DKIM page.

1. In the Google Admin console, go to Menu > Apps > Google Workspace > Gmail, then click Authenticate email.
2. In the Selected domain menu, choose the domain. Click Generate New Record.
3. Set the DKIM key bit length to 2048. Leave the prefix selector as google, unless the domain already has a key with that prefix. Click Generate.
4. Copy the DNS Host name (TXT record name) and the TXT record value. Do not click Start authentication yet.
5. At your DNS host, create a TXT record with that name and value. Google gives the name as google._domainkey; if your host asks for the full name, enter google._domainkey.example.com.
6. Back in Authenticate email, select the domain and click Start authentication. The status changes to “Authenticating email with DKIM”.

The record you publish in step 5 looks like this:

Type:  TXT
Host:  google._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A... (your key)

Google says DKIM can take up to 48 hours to start working once the key is in DNS. Until then the page may show “You must update the DNS records for this domain”, which you can ignore if the record is published. If you have just turned on Gmail, wait 24 to 72 hours before generating a key. If Squarespace is your domain provider, the key is created and published for you, so go straight to step 6.

If your DNS host rejects the 2048-bit key

A 2048-bit key is longer than the 255 characters one DNS text string can hold. Google's DKIM troubleshooting page gives the fix: split the value into several strings, each in quotes, entered one after another in the TXT value field. Receivers join them back together with no spaces (RFC 6376, section 3.6.2.2).

"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...first part of the key"
"...the rest of the key"

Google's other options are a 1024-bit key or asking your host about longer records. Treat 1024 bits as the last resort. RFC 8301 says signers should use at least 2048 bits, and Gmail's sender guidelines recommend 2048 where your provider supports it.

Check that Google is signing

Send a message to someone on Gmail or Google Workspace, because a test sent to yourself does not show the result. In Gmail, open the message, click More, then Show original. The Authentication-Results line should show dkim=pass for your domain. Our Email Header Analyser reads those headers for you, and our DKIM checker flags a key shorter than 2048 bits.

Step 3: add your DMARC record

Once SPF and DKIM have authenticated your mail for at least 48 hours, publish one TXT record at _dmarc. Google's Set up DMARC page notes that nothing changes in the Admin console for this step.

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Google gives the host as _dmarc.example.com and warns that some DNS hosts add the domain for you. If yours does, enter _dmarc alone. p=none is monitoring only: receivers deliver your mail as before, and those that send reports send them to you. Google recommends starting there, and What is DMARC? explains each tag.

The rua= tag sets the reporting address, which Google recommends always including. Use a dedicated group or mailbox: a large organisation can receive thousands of reports a day. An address on another domain works only if that domain publishes an authorisation record, which our DMARC checker tests.

Google's example record also includes pct=100 and strict alignment (adkim=s; aspf=s). Leave both out. RFC 9989, which replaced RFC 7489 in May 2026, removed pct (Appendix A.6). The default relaxed alignment lets mail signed by mail.example.com count for example.com.

Gmail does not support ruf=, so Google sends no failure reports. Our DMARC generator builds the record without pct.

What are the DMARC reports from Google?

Once your rua= tag is live, Google sends an aggregate report from noreply-dmarc-support@google.com for each day it sees mail from your domain. The XML report arrives as a compressed attachment, with a subject that starts “Report domain:”. Google does not document the sender or subject, but its About DMARC reports page explains the XML.

Each report lists the IP addresses that sent mail as your domain to Gmail and Google Workspace users. For each one it gives a message count, the SPF and DKIM results, and what Google did with the mail. Your own Workspace mail appears from Google's servers, with DKIM passing for your domain at the google selector.

A DKIM pass for a domain ending gappssmtp.com is Google's own signature, not yours, so it does not align. On your Workspace mail it usually means DKIM is not on for that domain yet, though Google's help pages do not document this signature.

Rows from addresses you do not recognise are usually a sender you have not set up, a forwarder or a spoofer. Google reports only on mail that reached Google. Other receivers send their own reports or none, so a quiet day is not proof that no mail was sent.

To read one, drop the attachment into our DMARC report viewer, which opens .zip, .gz and .xml files in your browser.How to read a DMARC RUA XML report explains each field, and what to do with what the reports show covers which senders to fix first.

What needs fixing before you enforce?

Third-party senders

Website forms, CRMs, newsletter tools and helpdesks often send as @example.com from their own servers. Your Google DKIM key does not sign that mail. Google's Set up DMARC page says that mail must pass SPF and DKIM too. Ask each provider to set both up for your domain, or route its mail through Google's SMTP relay service.

Ask for DKIM first: many services give you a TXT or CNAME record to publish at their own selector. An SPF include helps DMARC only when the service uses your domain as its envelope sender; otherwise it spends a lookup for nothing. Our DKIM checker page shows how to set up DKIM for SendGrid, Mailchimp, HubSpot and others.

Groups, forwarding and mailing lists

Forwarding rules, Google Groups and mailing lists resend your message to new recipients. Gmail's forwarding guidance says forwarded messages often fail SPF, and that changing the subject or body can break DKIM. RFC 9989 adds that DKIM signatures generally survive relaying when SPF does not (section 7.4). So expect some failures in your reports from forwarders rather than attackers.

Lists that add a subject tag or a footer usually break DKIM too. RFC 9989 notes that list mail which keeps your From address is frequently rejected at p=reject. It adds that list software now rewrites the address to avoid this. Send a test through each group and list your staff use, and check the headers before you enforce.

Secondary domains and domain aliases

Google's set-up pages say to repeat each step for each domain. A secondary domain or domain alias needs its own SPF and DMARC records, and a unique DKIM key from the Admin console. Mail from @example.net passes DMARC only when SPF or DKIM aligns with example.net.

A domain that sends no mail should publish v=spf1 -all and a DMARC record at p=reject. DMARC for parked and non-sending domains has the full set.

When can I move to quarantine and reject?

Stay at p=none until your reports show each legitimate sender passing with aligned SPF or DKIM. Before p=reject, each one must also sign with aligned DKIM (RFC 9989, section 7.4). The gate is clean reports, not a date, though that section asks a domain whose users post to mailing lists for at least a month at p=none and as long again at p=quarantine. The DMARC p=none to p=reject rollout runbook covers when each move is safe, what to check first and how to roll back.

Google's Recommended DMARC rollout page suggests a week at p=none, then raising pct in stages. Do not use pct. RFC 9989 retired it, and receivers on the older standard still apply a value below 100, which leaves part of your mail at the weaker policy.

p=quarantine (send fakes to spam) usually puts failing mail in junk. p=reject (refuse fakes) asks receivers to refuse it; each receiver makes the final decision (RFC 9989, section 5.4). DMARC covers your own domain and its subdomains. It does nothing about lookalike domains that differ from yours by a letter.

Does Gmail require DMARC?

Gmail requires DMARC from bulk senders. Google's Email sender guidelines set extra rules for anyone sending more than 5,000 messages a day to personal Gmail accounts, at @gmail.com or @googlemail.com. Those senders must publish SPF, DKIM and DMARC. A p=none policy is enough, but the From domain must align with SPF or DKIM, and marketing mail needs one-click unsubscribe.

All other senders need SPF or DKIM. Gmail may send unauthenticated mail to spam, or reject it with a 5.7.26 error. Bulk sender requirements 2026 covers Yahoo and Microsoft too.

Where ShieldMarc fits

Our free tools check each step, with no account. The DMARC checker validates your record against RFC 9989 and looks for your key at the google selector. The SPF checker counts your lookups out of 10.

For ongoing reports, point rua= at the address ShieldMarc gives you, and we read Google's reports alongside those from other receivers. Starter is free for one domain. Professional covers 25 domains for £50 a month billed annually, or £70 monthly, excluding VAT.

Professional can email you when a DKIM key is removed, revoked or weakened, or when your DMARC policy changes. Each sign-up starts with a 30-day trial, no card needed.

Frequently asked questions