How to set up SPF, DKIM and DMARC for Google Workspace
For Google Workspace, add an SPF record v=spf1 include:_spf.google.com ~all, turn on DKIM in the Admin console (Apps then Google Workspace then Gmail then Authenticate email) and publish the generated key, then add a DMARC record at _dmarc.yourdomain starting at p=none. This meets Google's own bulk-sender requirements.
- ›
Add SPF
TXT at the root: v=spf1 include:_spf.google.com ~all. If you send from other services too, add their includes and keep it under 10 lookups.
- ›
Turn on DKIM
Admin console then Apps then Google Workspace then Gmail then Authenticate email. Generate the key (2048-bit), then add the shown TXT record at google._domainkey, and click Start authentication.
- ›
Add DMARC
TXT at _dmarc.yourdomain: v=DMARC1; p=none; rua=mailto:you@yourdomain. Watch reports, then move to quarantine and reject.
Paste this into Google Workspace (or any AI builder) and fill the {braces}.
I use Google Workspace for {yourdomain.com}. Walk me through enabling DKIM in the Admin console and give me the exact SPF and DMARC TXT records to publish so my Gmail-sent mail passes DMARC and meets Google's bulk-sender rules.FAQ
Why is Gmail asking for DMARC?
Since 2024, Google and Yahoo require SPF, DKIM and a DMARC record for bulk senders. Without them your mail is rate-limited or rejected.
What DKIM key length should I use?
Use 2048-bit. Google defaults to 1024-bit for compatibility, but 2048-bit is stronger and widely supported.
Run your domain through our free checkers to confirm SPF, DKIM and DMARC resolve correctly.
Monitor this automatically
DeliverSignal runs these checks daily and alerts you when something breaks.
Start your free 14-day trial