To let Google Workspace send as you, add include:_spf.google.com to your SPF.
On the domain you send from (the root, @). Gmail for your domain sends with your domain as the envelope sender, so the include is what lets SPF pass and align. Measured on 5 Nov 2026, the include costs 1 of your 10 SPF lookups, leaving 9 for everything else.
- Include
- _spf.google.com
- Vendor’s record
- v=spf1 include:_spf.google.com ~all
- Where it goes
- Your domain’s SPF record (@)
- Needed on your root?
- Yes, if you send through it from your domain
- Lookups (measured)
- 1 of 10
- Ranges published
- 2 ip4 · 6 ip6
- Category
- Mailbox provider
What include:_spf.google.com expands to live, 5 Nov 2026
v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all
Counted as RFC 7208 §4.6.4 does: the include itself plus every nested include, a, mx, ptr, exists and redirect. Includes can change at any time; this page re-measures daily.
DKIM for Google Workspace
TXT key at google._domainkey by default, generated in the Admin console (Apps → Google Workspace → Gmail → Authenticate email).
How it affects DMARC
DMARC passes when SPF or DKIM passes for a domain aligned with your From address. With Google Workspace sending from your domain, its include lets SPF pass and align; DKIM signing with your domain gives you a second, forwarding-proof way to pass.
Other mailbox provider services
Sources
- Google Workspace Admin Help: Set up SPF · checked 5 Oct 2026
- Google: Set up DKIM · checked 5 Oct 2026
- RFC 7208 §4.6.4: DNS lookup limits · checked 5 Oct 2026
peekip isn’t affiliated with Google Workspace; follow the vendor’s own setup page, which shows the exact values for your account.