Guide

How to set up SPF, DKIM, and DMARC for Google Workspace

Google Workspace gives you the tools to authenticate your email, but the setup is scattered across multiple dashboards. Here is a step-by-step guide to get all three protocols configured correctly.

Check your Google Workspace setup in seconds

The free InboxProof audit runs a 7-point check (MX, SPF, DKIM, DMARC, TLS, PTR, and IP reputation) and returns a 0-100 score with a plain-English fix list. No signup.

Run the free check

Step 1: Enable DKIM in Google Workspace

DKIM signs your email with a private key, proving it was sent by you. Google Workspace has DKIM enabled by default, but you should verify it.

Go to the Google Admin console (admin.google.com).
Navigate to Apps → Google Workspace → Gmail → Authenticate your email.
Under "DKIM signing," make sure it is enabled.
Note the DKIM selector (e.g., google).

Google automatically publishes the DKIM public key as a TXT record. You do not need to add it manually.

Step 2: Configure SPF

SPF tells receiving servers which IPs are allowed to send email on behalf of your domain. For Google Workspace, the SPF record should include Google's sending services.

Add this TXT record to your DNS:

v=spf1 include:_spf.google.com -all

If you use other sending services (e.g., a marketing tool), add their include: entries. Keep the total DNS lookups under 10.

Step 3: Publish a DMARC record

DMARC ties SPF and DKIM together and tells receivers what to do with unauthenticated email. Start with a monitoring policy:

v=DMARC1 p=none rua=mailto:dmarc-reports@yourdomain.com

Add this as a TXT record at _dmarc.yourdomain.com. After a few weeks of monitoring, move to p=quarantine, then p=reject.

Step 4: Verify the setup

Run the free InboxProof audit to confirm all three protocols are configured correctly. The audit checks:

SPF record exists and is valid
DKIM key is published and strong
DMARC record exists with a reporting address
Alignment between your "From" domain and the SPF/DKIM domains

Common pitfalls

SPF record too long

If you include many services, you may exceed the 10-DNS-lookup limit. Use ip4: or ip6: mechanisms instead of include: where possible.

DKIM selector mismatch

Make sure the DKIM selector in your DNS matches the one in Google Workspace. If they do not match, DKIM will fail.

DMARC domain mismatch

The DMARC record must be at _dmarc.yourdomain.com, not at the root. If it is in the wrong place, it will not be found.

Verify your Google Workspace setup

Run the free audit and see if your SPF, DKIM, and DMARC are configured correctly.

Run a free audit

Want this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →