Ruvalin

With your provider · Google Workspace

Setting up SPF, DKIM and DMARC on Google Workspace

On Google Workspace, SPF comes down to include:_spf.google.com. DKIM is generated from Menu, Apps, Google Workspace, Gmail, “Authenticate email”, with the google selector and a 2048-bit key. DMARC you publish yourself in your DNS, because Google does not manage your zone. The forgotten step is the “Start authentication” button, without which nothing is signed.

By Tom GernezUpdated 5 min read

Key points

  • SPF is one line: v=spf1 include:_spf.google.com -all.
  • DKIM: Menu → Apps → Google Workspace → Gmail → Authenticate email. Default selector: google.
  • You must wait 24 to 72 hours after enabling Gmail before a DKIM key can be generated at all.
  • Generating and publishing the key is not enough: you then have to click “Start authentication”.
  • Google does not publish your DMARC record. That is yours to do, at your registrar or DNS host.

SPF, in one line

Google publishes its entire sending estate behind a single include. It is the simplest case there is, and it is also what makes exceeding the ten-lookup limit so easy to avoid here: as of 22 August 2026 that include is flattened, so it costs a single lookup, and there is only one of it.

A domain served only by Google Workspace
example.com.  IN  TXT  "v=spf1 include:_spf.google.com -all"

DKIM, and the two waits

  1. 01

    Open the authentication page

    In the Admin console: Menu, then Apps, then Google Workspace, then Gmail, then “Authenticate email”. Select the domain if you have more than one.

  2. 02

    Generate the key

    Choose 2048 bits, unless your DNS host refuses long values, in which case 1024 is the fallback. The selector prefix is google by default; keep it, unless another service already signs with that name on the same domain.

  3. 03

    Publish the TXT record

    Google gives you a host name and a value. The name is google._domainkey, the value starts with v=DKIM1. Some DNS hosts will not accept a single string longer than 255 characters: it then has to be split into several quoted strings, which most interfaces do for you.

    google._domainkey.example.com.  IN  TXT
  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."
  4. 04

    Start authentication

    This is the step almost everybody forgets. Go back to the page and click “Start authentication”. Until that button has been clicked, the key is published but Google signs nothing.

DMARC, which Google will not do for you

Google runs your mail, not your domain name. The DMARC record is therefore published wherever your DNS zone lives: at OVH, Gandi, IONOS, Cloudflare, or your registrar. The Admin console offers nothing for it, and that is correct.

The first record, in monitoring
_dmarc.example.com.  IN  TXT
  "v=DMARC1; p=none; rua=mailto:reports@example.com"

Stay in monitoring for two to four weeks, long enough to inventory the other services sending in your name, then tighten in stages. The procedure is in the guide on moving to rejection.

Verifying it is all in place

The three records, seen from outside
dig +short TXT example.com | grep spf1
dig +short TXT google._domainkey.example.com
dig +short TXT _dmarc.example.com

The decisive check, though, is on a real message. Send yourself an email from the domain to a personal Gmail address, open it, then “Show original”. All three lines, SPF, DKIM and DMARC, should read PASS, and the domain shown beside DKIM must be exactly yours.

Google Workspace's special cases

SituationWhat to know
Domain aliasAn alias inherits the primary domain's configuration on Google's side, but it needs its own SPF, DKIM and DMARC records in its own zone.
Secondary domainTreated as a domain in its own right: it needs a separate DKIM key generated for it.
Outbound routing through a gatewayIf outbound mail goes through a third-party relay, the IP address changes and SPF has to authorise it. DKIM survives, provided the relay does not modify the message.
Google GroupsA group forwarding an external message breaks SPF, and can break DKIM if it appends a footer. That is a forwarding case, not a configuration error.
Key rotationGenerating a new key breaks nothing while the old one stays published: Google signs with the new one and messages in flight still verify against the old.

What this page does not cover

Google protects what arrives in your mailboxes very well. Nothing described here concerns inbound mail: this is only about messages going out with your name on them, from servers belonging neither to you nor to Google, addressed to your clients. Google has no way of stopping those, and does not configure your domain for you.

And once all three records are live, cousin domains and misleading display names still go through. That is covered in the article on what DMARC does not stop.

Common questions

Sources

Definitions

  • DMARC: the complete guide

    What DMARC is, how to read the record, how to publish it and how to move it to rejection without breaking your mail. Written by a consultant who deploys it, with the exact values.

  • Moving DMARC to reject without breaking your mail

    The rollout to p=reject, stage by stage, over two to three weeks. How to read the reports, align every legitimate sender, and how to tell when it is safe to tighten.

  • Setting up SPF, DKIM and DMARC on Microsoft 365

    The exact Defender portal path, the two selector1 and selector2 CNAMEs, and the onmicrosoft.com trap that makes DKIM pass while DMARC fails.

Want to know what is published on your domain? The check is free, takes no sign-up, and reads only public records. Check your domain

Tom Gernez · Independent information security consultant. Ruvalin sets up email authentication for small French firms and professional practices.

All guides

CallBook