SPF, DKIM and DMARC for Google Workspace
Google Workspace needs the same three records as any sender: SPF, a DKIM key you generate in the Admin console, and DMARC. Gmail’s email sender guidelines, in force since 1 February 2024, require all three from bulk senders (about 5,000 or more messages a day to personal Gmail accounts); mail that doesn’t comply may be rejected or marked as spam (Google; see Sources below).
1. SPF
Publish one SPF TXT record at the root that includes Google, plus any other services that send as your domain.
2. DKIM
In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email, choose your domain and generate a new 2048-bit key. The default selector is google.
Publish the TXT record Google shows at google._domainkey, wait for DNS, then press Start authentication.
3. DMARC
Start with p=none and a report address, then tighten to quarantine and reject once reports show aligned passes for all your senders.
MX
Use the MX values the Admin console gives you during setup. Newer setups use a single record pointing to smtp.google.com; older five-record setups keep working.
Check your setup
Sources
- Bulk senders (about 5,000+ messages a day to personal Gmail accounts) must set up SPF, DKIM and DMARC; non-compliant mail may be rejected or marked as spam. Requirements in force since 1 February 2024. Google Workspace Admin Help: “Email sender guidelines” — living help page; requirements announced October 2023, in force since 1 February 2024; checked 14 October 2026.
Other provider: SPF, DKIM and DMARC for Microsoft 365