Google Workspace DMARC setup

Updated 2026-07-08 · Setup Guides

Google Workspace is the friendly case in email authentication. Google sends your mail from your own domain end to end, so once SPF and DKIM are configured, both align with your visible From domain automatically — no custom return-path tricks, no CNAME indirection. The whole job is two DNS records, one switch in the Admin console, and a DMARC record to watch the results.

Step 1: SPF — one include

Google publishes the complete list of its sending servers behind a single hostname. Your SPF record delegates to it:

example.com.   TXT   "v=spf1 include:_spf.google.com ~all"

If your domain already has an SPF record, don't add a second one — a domain may only have one, and two make both invalid. Edit the existing record instead and add include:_spf.google.com before the all mechanism, leaving your other services' includes in place. Why ~all is the sensible qualifier, and what the ten-lookup limit means for records that accumulate includes over the years, is covered in What is SPF?

Because Google uses your own domain in the envelope-from, an SPF pass here is an aligned pass — it counts for DMARC.

Step 2: DKIM — generate, publish, then turn it on

DKIM is where Google Workspace setups most often stall, because it is a three-part job and the third part is the one everyone forgets.

Generate the key. In the Admin console (admin.google.com), open Gmail's Authenticate email settings — the Admin console's search box finds it fastest, wherever Google has moved it this quarter. Select your domain and generate a new record. Keep the defaults: a 2048-bit key and the selector google.

Publish the TXT record. The console shows you a DNS record to create at your provider:

Copy the value exactly — the key is long, and a truncated paste is the classic failure. If your DNS provider complains about length, it supports splitting long TXT values into quoted chunks; use its own splitting rather than trimming the key.

Turn signing on. This is the forgotten step. Publishing the key does nothing by itself — go back to the same Admin console page and press Start authentication. Until you do, Gmail keeps signing your mail with its stock gappssmtp.com fallback signature: technically a valid DKIM signature, but on a Google domain rather than yours, so it does nothing for alignment. If the button reports that the record can't be found, DNS simply hasn't propagated yet — wait an hour and try again.

Verify both are aligned

Send a message from your domain to any Gmail mailbox you control, open it, and choose Show original. Gmail's summary table at the top should show all three passing:

SPF:   PASS with IP x.x.x.x
DKIM:  PASS with domain example.com
DMARC: PASS

The detail that matters is the domain on the DKIM line: it should be your domain (example.com), not gappssmtp.com and not a Google domain. That is alignment, and it is what DMARC actually evaluates — the mechanics are unpacked in DMARC alignment explained.

You can also run your domain through the free checker to confirm the SPF and DMARC records are published and syntactically valid from the outside.

Publish DMARC and watch

With SPF and DKIM aligned, publish a DMARC record at _dmarc on your domain, starting at p=none — pure monitoring, nothing blocked:

_dmarc.example.com.   TXT   "v=DMARC1; p=none; rua=mailto:…"

The rua= address is where aggregate reports go; point it at a monitor so the reports become readable. Add your first domain walks the exact DMARCmetric flow, including the per-domain reporting address.

Then give it a week of reports. If Google Workspace is your only sender, you'll likely see clean alignment almost immediately and can start moving towards p=quarantine. If newsletters, invoicing tools or a CRM also send as your domain, each needs its own alignment work first — see Third-party senders and DMARC. And if you send bulk mail to Gmail addresses, remember that Google now requires DMARC from bulk senders regardless.