How to set up SPF, DKIM, and DMARC for Google Workspace?

Complete guide to configuring email authentication for Google Workspace (formerly G Suite).

1. SPF Record Add this TXT record to your domain's DNS:

v=spf1 include:_spf.google.com -all

Note: _spf.google.com resolves to ~4 DNS lookups. If combining with other services, watch the 10-lookup limit.

2. DKIM Setup

1. Go to admin.google.com → Apps → Google Workspace → Gmail → Authenticate email
2. Select your domain
3. Click "Generate new record"
4. Choose 2048-bit key length
5. Add the TXT record Google provides at google._domainkey.yourdomain.com
6. Click "Start authentication" in the admin console

Example DKIM record:

google._domainkey TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhki..."

3. DMARC Record Add at _dmarc.yourdomain.com:

v=DMARC1; p=quarantine; rua=mailto:[email protected]; fo=1

Verification: Scan at https://intodns.ai — the scan checks the google DKIM selector by default.

Google Workspace specific tips:

• DKIM key generation takes up to 48 hours to start working
• Default selector is google — don't change it unless you have a reason
• Google Workspace sends from multiple IPs (covered by _spf.google.com)
• Apps Script and Google Forms emails also use your domain's DKIM
• If using Google + another ESP, both need DKIM configured separately

Generate records: https://intodns.ai/tools/spf-generator