SPF, DKIM and DMARC on Google Workspace: the records and the order

Gmail delivers your mail from the day you sign up, but refusing forgeries of it takes three records: SPF, a DKIM key you generate in the Admin console, and a DMARC policy. Google's own pages give the order and the waits.

By Oscar CobbeCurrent as at 29 October 20263 minute read3 sources

Step 1: SPF

If Google Workspace is the only thing that sends email as your domain, Google's record is v=spf1 include:_spf.google.com ~all, published as a TXT record at the root of the domain (the host shown as @ at most DNS providers). Each other service that sends as you adds its own include: to the same record: one record, never two.

Google recommends ending it ~all, which asks receivers to treat mail from unlisted servers as suspect. Microsoft recommends -all for its own customers. Either way, the decision to refuse forged mail is made by your DMARC policy in step 3, not here. Google's page also caps the record at ten include: tags, which is the simple form of SPF's ten-lookup limit; what happens when you go over it.

Step 2: generate and publish a DKIM key

In the Admin console, go to Menu, then Apps, then Google Workspace, then Gmail, and open Authenticate email. You need to be a super administrator to generate the key.

1Choose the domain and generate a new record. Pick a 2048-bit key if your DNS host accepts one; Google says to use 1024 only where it does not.
2Leave the selector prefix as google, unless the domain already has a key under that name.
3Publish the TXT record Google shows, at the host google._domainkey, with the value Google gives, beginning v=DKIM1; k=rsa; p=.
4Only then press Start authentication in the Admin console. Google says not to press it before the record is published.

The two waits

Google says that after Gmail is first turned on for a domain you may wait 24 to 72 hours before the Admin console will give you a DKIM key, and that DKIM can take up to 48 hours to start working once the record is published.

Step 3: DMARC at p=none, then up

Google asks for SPF or DKIM to have been authenticating your mail for at least 48 hours before you turn DMARC on. The record is a TXT record at _dmarc.yourdomain.ie. Start with p=none and a report address: v=DMARC1; p=none; rua=mailto: followed by a mailbox you will read.

Google recommends always asking for reports, and warns that there can be a lot of them: use a group or a dedicated mailbox, or a reporting service, not your own inbox. A report address on another domain needs that domain's permission in its own DNS.

When the reports show your own mail passing from every service that sends it, move to p=quarantine and then p=reject. Google's page describes the optional pct tag for applying the policy to a share of failing mail first.

The services that send as you

Gmail is rarely the only sender. An invoicing package, a newsletter tool, a booking system or a website form can all send email from your domain, and each needs either its own DKIM key in your domain's name or a bounce address on your domain, set up inside that service. Until it has one, its mail fails DMARC, and at p=reject it is refused.

That list of senders is the reason the reports come first. Our general guide to what SPF, DKIM and DMARC decide goes through reading them.

Checking it worked

In Gmail, open a message you sent to another account, choose Show original, and look for SPF: PASS, DKIM: PASS with your own domain, and DMARC: PASS. Then run the free email security check: it should find a DKIM key under google and show your DMARC policy enforced.

Sources

Free, and no account needed

Check your Google Workspace domain, free

Reads your SPF, DKIM and DMARC records from public DNS and shows whether a key is published under the google selector and what your DMARC policy tells receivers to do.

Run the free check

Email protection, €450 once

We find every service that sends as your domain, set DKIM for Google Workspace and for each of them, and move DMARC from none to reject once the reports show your own mail passing. A second scan shows it in place from outside.

See the prices

Who wrote this

Oscar Cobbe · Founder, FourWinds Digital

Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.

More about how we work →