Set up SPF, DKIM and DMARC with Google Workspace

Before you start

Google does not manage your DNS zone: SPF, DKIM and DMARC are published at your domain host, usually the place where you bought it. The DNS zone pages are named differently from one host to another, but always look for the place where TXT records are added.

For the DKIM key, you need administrator access to the Google Admin console. If Gmail has just been turned on for the domain, Google says you must wait 24 to 72 hours before the key appears in the console.

SPF for Google Workspace

1. Sign in at the DNS host of your domain and open the page where TXT records are updated.
2. Add or update the TXT record with the value below.

Each domain can have only one SPF record: if you also use another sending service, combine everything in a single line. Each subdomain that sends emails needs its own SPF.

DKIM for Google Workspace

1. In the Google Admin console: Menu, Apps, Google Workspace, Gmail, then "Authenticate email". Choose your domain.
2. Generate the key. Choose 2048 bits if your DNS host accepts them, otherwise 1024 bits. The default selector prefix is google; if the domain already uses a key with that prefix, enter another one.
3. Copy the DNS host name (for example google._domainkey) and the TXT record value shown by the console, and publish them at your DNS host.
4. Go back to the console and click "Start authentication". Only do this after you have published the record.

Google says it can take up to 48 hours before DKIM authentication works. Some DNS hosts limit the length of a TXT record: this is the usual cause of a rejected 2048-bit key, in which case use 1024 bits.

DMARC for Google Workspace

There is nothing to do in the Admin console for DMARC: the record is published only at your DNS host. Google asks that SPF and/or DKIM be turned on first, and that you wait 48 hours after they are in place.

1. At your DNS host, create a TXT record whose name is _dmarc.yourdomain.com (depending on the host, entering _dmarc is enough).
2. Enter the value below. Google recommends always including the rua address, pointing to a dedicated mailbox or group.

Google recommends starting with p=none and then, over time, moving to quarantine or reject. Keep p=none for a few weeks, long enough to read the reports sent to the rua address and spot legitimate sending that still fails. Then move to p=quarantine, then to p=reject once nothing legitimate is flagged anymore.

Common mistakes

• Clicking to start DKIM authentication before the TXT record has been published.
• Trying to publish SPF or DMARC in the Google console: they are published at the DNS host.
• Ending up with two SPF records because a sending tool added its own line: combine them.
• An "update your DNS records" message that stays displayed in the console: Google says it can stay for up to 48 hours.

Frequently asked questions

Official sources

• Google: set up SPF
• Google: set up DKIM
• Google: set up DMARC
• Google: email sender guidelines

Interfaces and values taken from the official documentation on October 15, 2026. Providers sometimes change their menus: if there is a discrepancy, the official page prevails.

A refusal message to decode?

Once authentication is in place, the remaining refusals have other causes. Each guide explains how to tell them apart.

• Error 550 5.7.1
• Error 550 5.7.26
• Error 550 5.1.1
• Error 421 and 451
• Error 554

Another mail provider?

• Microsoft 365