Google Workspace email setup: SPF, DKIM and DMARC step by step

Before you start

You need admin access to Google Workspace and to the DNS settings at your domain host (often where you bought the domain). Make a note of every other service that sends email as your domain, such as a newsletter tool or a shop; they matter in step 1 and in DMARC later.

Step 1: SPF

Google’s recommended SPF record for Workspace is:^[1]

v=spf1 include:_spf.google.com ~all

At your DNS host, add a TXT record with host @ (or your domain name) and that value. If a record starting v=spf1 already exists, edit it to add include:_spf.google.com rather than adding a second one: a domain must not have two SPF records, and two cause a permanent error.^[5] Google notes that SPF can take up to 48 hours to start working.^[1]

Each include: costs at least one DNS lookup, and the SPF standard caps evaluation at 10.^[5] If you add many services, check the total.

Step 2: DKIM

1. In the Admin console go to Menu › Apps › Google Workspace › Gmail › Authenticate email.^[2]
2. Select your domain and generate a new record. Choose 2048 bits if your DNS host supports it (“Longer keys are more secure than shorter keys”); otherwise 1024.^[2]
3. Keep the default prefix selector, google. Google says it is the recommended option.^[2]
4. At your DNS host add a TXT record with host google._domainkey and the long value Google shows, starting v=DKIM1;.
5. Back in the Admin console, click Start authentication. Google notes it can take up to 48 hours for DKIM to start working; the status then reads “Authenticating email with DKIM”.^[2]

Some DNS hosts split long TXT values into several quoted strings. That is fine; receivers join them.

Step 3: DMARC

Google asks you to allow 48 hours after setting up SPF and DKIM before adding DMARC.^[3] Then add a TXT record at host _dmarc (_dmarc.yourdomain.com) with a monitoring policy and a mailbox for reports:

v=DMARC1; p=none; rua=mailto:[email protected]

p=none changes nothing about delivery. It asks receivers to send you aggregate reports so you can see every service that sends as your domain before you enforce anything.

Moving past p=none

Google’s guide suggests tightening over time, to quarantine and then reject, as you learn how your mail authenticates, and it still describes the pct tag for a gradual rollout.^[3] The current DMARC standard, RFC 9989 (May 2026), removed pct and added a test flag instead: with t=y, receivers apply one level lower than the published policy, so p=quarantine; t=y behaves like p=none while reports keep coming.^[4] A receiver still working to the older standard doesn’t know t= and may apply the published policy as written, so only publish p=quarantine; t=y once you would accept real quarantining too.

Common mistakes

• Two SPF records (one from an old host, one for Google). Merge them.
• DKIM published but Start authentication never clicked.
• DMARC added with p=reject on day one, before a newsletter tool was signing with your domain.
• A typo in the host name: it is google._domainkey and _dmarc, and many hosts add your domain automatically, so don’t type it twice.

Sources

1. Set up SPF · Google Workspace Admin HelpChecked 5 Oct 2026
2. Set up DKIM · Google Workspace Admin HelpChecked 5 Oct 2026
3. Set up DMARC · Google Workspace Admin HelpChecked 5 Oct 2026
4. RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC) (May 2026) · IETF / RFC EditorChecked 5 Oct 2026
5. RFC 7208: Sender Policy Framework (SPF) (Apr 2014) · IETF / RFC EditorChecked 5 Oct 2026