Google Workspace SPF, DKIM, and DMARC Setup

For Google Workspace, a good email authentication setup usually means three things: Google is authorised to send mail for the domain, outbound mail is signed with DKIM, and DMARC is published so receivers know how to treat failing mail.

You are not just adding records because a checklist says so. You are building a setup that supports deliverability, spoofing protection, and clearer reporting.

A common starting SPF record for a Google Workspace-only environment is based on include:_spf.google.com. If other systems also send mail for the domain, those authorisations must be included carefully in the same SPF policy.

v=spf1 include:_spf.google.com -all

Only one SPF record should exist for the domain. If old provider records are left behind, SPF can fail with PermError.

• SPF Checker
• How to fix SPF PermError

Google Workspace generates a DKIM selector and public key in the admin console. You publish that selector in DNS, then enable DKIM signing in Google after the record is live.

The selector is often google, but you should always use the exact selector Google gives you rather than assuming.

google._domainkey.example.com TXT "v=DKIM1; k=rsa; p=PUBLICKEY"

A common mistake is publishing the record but forgetting to enable signing in Google Workspace afterward.

• DKIM Checker
• How to fix DKIM failures

DMARC should be added once SPF and DKIM are in place and you understand who is sending mail for the domain. A common safe starting point is a monitoring policy with p=none and an aggregate reporting address.

_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

From there, you can tighten the policy over time if legitimate mail is consistently aligned.

• DMARC Checker
• How to fix DMARC failures

Google Workspace setups often become messy when another system also sends mail for the same domain. Marketing platforms, CRMs, and help desks may need their own SPF authorisations or aligned DKIM configuration.

If you ignore those extra senders, DMARC may look correct in DNS while real mail still fails in production.

• MX records point where you expect for Google Workspace
• The SPF policy includes Google's sending infrastructure and only one SPF record exists
• The DKIM selector resolves in DNS and Google is actively signing mail
• The DMARC record is valid and the reporting address is intentional
• A real test message shows aligned pass results where expected

• Confirm the intended Google Workspace MX design
• Publish one valid SPF policy
• Generate and publish the Google DKIM selector
• Enable DKIM signing in Google Workspace
• Publish a DMARC record starting with monitoring
• Send a test message and inspect the resulting authentication headers

If you want to validate this topic in practice, these DNS Pro tools are the fastest next step.

• Email Provider Setup Checker
• Email Security Check
• SPF Checker
• DKIM Checker
• DMARC Checker