Google Workspace SPF, DKIM and DMARC: the exact records, step by step

Google Workspace needs four DNS records per domain to deliver well: MX, SPF, DKIM and DMARC. Here are the current values, the order to add them in, and how to keep them right across many domains.

The full record set

Step 1: MX record

Google’s current MX setup is a single record:

example.com.  3600  MX  1 smtp.google.com.

Remove any MX records left from your previous host. If your domain already uses the older five-record set, you do not need to change it. Google still supports it:

example.com.  MX   1 aspmx.l.google.com.
example.com.  MX   5 alt1.aspmx.l.google.com.
example.com.  MX   5 alt2.aspmx.l.google.com.
example.com.  MX  10 alt3.aspmx.l.google.com.
example.com.  MX  10 alt4.aspmx.l.google.com.

Do not mix the two sets. Pick one. More on how the numbers work in MX record priority.

Step 2: SPF record

Add one TXT record on the root of the domain (@):

example.com.  3600  TXT  "v=spf1 include:_spf.google.com ~all"

Google recommends ending with ~all. If a newsletter tool, CRM or helpdesk also sends mail as your domain, add its include: to this same record. Two separate SPF records break SPF for the whole domain. Stay under 10 DNS lookups in total; the SPF checker counts them for you.

Step 3: DKIM in the Admin console

1. Sign in to the Google Admin console as a super administrator.
2. Go to Menu → Apps → Google Workspace → Gmail → Authenticate email.
3. Select the domain and click Generate New Record.
4. Choose a 2048-bit key (use 1024 only if your DNS host cannot store a long TXT value). Leave the prefix selector as google unless that name is already taken.
5. Click Generate. Copy the host name and the TXT value shown.
6. At your DNS host, create a TXT record named google._domainkey with that value.
7. Go back to the Admin console and click Start authentication. Do this only after the record is published.

google._domainkey.example.com.  3600  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...(copy the full key)"

Some notes from Google’s documentation. If you just turned on Gmail for the domain, you may have to wait 24 to 72 hours before the key can be generated. After publishing, DKIM can take up to 48 hours to start working. When it does, the status reads "Authenticating email with DKIM". To test, send a message to a different Gmail account, open "Show original" and look for dkim=pass. The DKIM checker reads the published key and its size.

Some DNS panels split a 2048-bit key into several quoted strings. That is fine. What breaks DKIM is a key cut short, or the panel appending your domain so the record ends up at google._domainkey.example.com.example.com.

Step 4: DMARC record

Google suggests waiting about 48 hours after SPF and DKIM are set up, then adding a DMARC record in monitoring mode:

_dmarc.example.com.  3600  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

p=none changes nothing about delivery. It asks receivers to send you daily aggregate reports, so you can see every service that sends as your domain and whether it passes.

Once the reports show your real mail passing SPF or DKIM in alignment for a few weeks, tighten the policy:

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
; later, when nothing legitimate fails:
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

The DMARC checker shows the policy each domain publishes right now.

Gmail’s bulk sender requirements

Since February 2024, Gmail has had rules for everyone who sends to personal Gmail accounts, and stricter ones for senders of more than 5,000 messages a day:

Google Workspace handles PTR and TLS for mail sent through Gmail. The parts that are on you are the DNS records above.

Doing this for 20 domains

The records are identical across domains except for the DKIM key, which is unique to each domain and must be generated one by one in the Admin console. With 20 domains, the usual failures are a domain added months later that never got DKIM, an SPF record someone duplicated while adding a newsletter tool, or a DMARC record that was never added at all.

1. Keep a list of every domain on the Workspace account, including secondary and alias domains.
2. Add MX, SPF and DMARC to all of them in one sitting. They are the same text each time.
3. Generate and publish DKIM per domain, then click Start authentication for each one.
4. Paste the whole list into the free bulk mail health checker. It checks MX, SPF, DKIM (including the google selector), DMARC, the STARTTLS certificate, blacklists and PTR for up to 25 domains at once and shows a copy-ready fix for anything that is not green.
5. Turn on weekly monitoring under the report, so a record that changes later does not go unnoticed.

Questions

Sources

• Google: Set up MX records for Google Workspace
• Google: Set up SPF
• Google: Set up DKIM
• Google: Set up DMARC
• Google: Email sender guidelines