SPF, DKIM and DMARC for Google Workspace

The DNS records Google Workspace needs so your mail is authenticated and stays out of spam.

SPF	TXT at `@`	v=spf1 include:_spf.google.com ~all Google's include costs about 4 of SPF's 10 DNS lookups, so leave room for your other senders. Combine with your other senders →
DKIM	CNAME / TXT	TXT record at `google._domainkey` with the 2048-bit key generated in the Admin console.
DMARC	TXT at `_dmarc`	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Start with `p=none` and a mailbox you read; build your own.

Step by step

Add the SPF record below at your root domain (host @). If you already have an SPF record, add include:_spf.google.com to it instead of creating a second one.
In the Google Admin console open Apps → Google Workspace → Gmail → Authenticate email, pick your domain and click Generate new record (2048-bit, prefix google).
Publish the TXT record it shows at google._domainkey, wait until your DNS host serves it (usually minutes) and click Start authentication.
Add the DMARC record with p=none, read the reports for a couple of weeks, then move to p=quarantine and p=reject.

DKIM is off by default: until you click Start authentication Gmail signs with a gappssmtp.com key, which does not count for your domain's DMARC.
Some DNS hosts cut long TXT values. If the 2048-bit key will not save, split it into several quoted strings or generate a 1024-bit key.
Mail sent by other tools (website forms, CRM, invoicing) does not go through Google: each needs its own SPF include and DKIM.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.