Google Workspace Email Authentication: SPF, DKIM and DMARC

Introduction

Google Workspace uses DNS records to route inbound email and authenticate outbound email for your domain. MX records route incoming mail to Gmail, while SPF, DKIM and DMARC help receiving mail servers verify that outgoing messages are authorized.

A correct Google Workspace setup usually includes Google MX records, an SPF record that authorizes Google’s sending infrastructure, DKIM signing enabled in Google Admin, and a DMARC policy published at _dmarc.yourdomain.com. If any part is missing or added in the wrong DNS zone, Gmail may still work, but authentication or delivery trust can suffer.

Quick answer

Google Workspace DNS

A typical Google Workspace email setup uses several DNS records:

MX records

MX records tell the internet where to deliver incoming email for your domain. For Google Workspace, the MX records should match Google’s current instructions.

If old hosting, cPanel, Plesk, Zoho, Microsoft 365 or another mail provider’s MX records remain active, incoming mail may route to the wrong place.

• MX Lookup →

SPF

If Google Workspace sends mail for your domain, SPF should authorize Google’s sending infrastructure.

v=spf1 include:_spf.google.com ~all

If you also send mail from other services, such as a CRM, website form, newsletter platform or billing system, do not create separate SPF records. Merge all legitimate senders into one SPF record.

v=spf1 include:_spf.google.com include:mailservice.example ~all

• SPF When Using Multiple Email Providers →

DKIM

DKIM for Google Workspace is generated and enabled inside Google Admin. Google provides a selector and a TXT value that must be published in your DNS zone.

google._domainkey.example.com

The exact selector and value should come from Google Admin.

1. 1. Open Google Admin DKIM settings

   Find DKIM authentication for the domain.

2. 2. Generate a DKIM record

   Create the DKIM key for your domain in Google Admin.

3. 3. Copy the selector and TXT value

   Use the exact values Google provides.

4. 4. Add the TXT record at the active DNS provider

   Publish at selector._domainkey.yourdomain.com.

5. 5. Wait until DNS is visible

   Allow DNS propagation before enabling signing.

6. 6. Start/enable authentication in Google Admin

   Turn on DKIM signing after DNS is detected.

7. 7. Send a test message

   Confirm DKIM passes on real outgoing mail.

DMARC

After SPF and DKIM are configured, add a DMARC record at _dmarc.example.com.

v=DMARC1; p=none; rua=mailto:dmarc@example.com

p=none lets you collect reports without asking receivers to quarantine or reject mail. Move to quarantine or reject only after confirming legitimate Google Workspace and third-party senders pass DMARC alignment.

• DMARC for Beginners: Policies, Alignment and Enforcement →

Setup order

1. Step 1: Confirm active DNS provider

   Check nameservers so you know where DNS records must be added.

2. Step 2: Set Google MX records

   Route inbound mail to Gmail using Google Workspace instructions.

3. Step 3: Add SPF

   Authorize Google with include:_spf.google.com and merge any other real sending providers.

4. Step 4: Enable DKIM

   Generate the DKIM record in Google Admin, publish it in DNS, then enable signing.

5. Step 5: Add DMARC

   Start with p=none and a reporting address.

6. Step 6: Test real messages

   Send mail to external providers and inspect SPF, DKIM and DMARC results.

Why this matters

Google Workspace authentication is especially important if your domain also uses newsletters, CRMs, billing systems or website forms.

How to check it

Use CheckDomainHealth tools to inspect MX, SPF, DKIM and DMARC records for your domain.

Common problems

How to fix it

1. Step 1: Check active nameservers

   Confirm where DNS is hosted before editing records.

2. Step 2: Verify MX records

   Use MX Lookup to confirm Gmail is the active inbound mail destination.

3. Step 3: Fix SPF

   Publish one SPF record that includes Google and any other real sending services.

4. Step 4: Generate DKIM in Google Admin

   Copy the selector and TXT value from Google Admin and publish it in DNS.

5. Step 5: Enable DKIM signing

   After DNS is visible, start authentication in Google Admin.

6. Step 6: Add DMARC monitoring

   Publish a p=none DMARC record and collect reports.

7. Step 7: Test external delivery

   Send messages to external mailboxes and check message headers for SPF, DKIM and DMARC results.

8. Step 8: Review third-party senders

   Authenticate newsletters, CRMs, billing platforms, website forms and transactional tools separately.

DNS examples

v=spf1 include:_spf.google.com ~all

v=spf1 include:_spf.google.com include:mailservice.example ~all

google._domainkey.example.com

v=DKIM1; k=rsa; p=PUBLIC_KEY_FROM_GOOGLE_ADMIN

v=DMARC1; p=none; rua=mailto:dmarc@example.com

dig example.com MX
dig example.com TXT
dig google._domainkey.example.com TXT
dig _dmarc.example.com TXT

Other senders

Many domains use Google Workspace for normal mailbox email and other services for newsletters, invoices, CRM messages, support tickets or website forms.

• Does it need an SPF include?
• Does it support custom DKIM?
• Does it align with DMARC?
• Does it use your domain in the visible From address?
• Does it appear in DMARC reports?

Frequently asked questions