SPF, DKIM and DMARC · Checked 8 November 2026

Google Workspace SPF, DKIM and DMARC records

The records that let mail sent through Google Workspace pass email authentication, and how to confirm they are published correctly.

Check your domain

Enter your domain, then pick the record to check:

SPF

example.com.  IN  TXT  "v=spf1 include:_spf.google.com ~all"
  • Publish it as a TXT record at the root of your domain (host @). Google recommends ending with ~all.
  • If other services also send mail as your domain, add an include: for each one to this same record. Never publish a second SPF record.
  • Each subdomain that sends mail needs its own SPF record.
  • Allow up to 48 hours for it to take effect.

Syntax and the 10-lookup limit are covered in SPF record syntax.

DKIM

  • In the Google Admin console you generate the DKIM key for your domain. The default selector is google, so the record name is google._domainkey and the type is TXT.
  • Google prefers a 2048-bit key. Use 1024 bits only if your DNS host cannot store the longer value.
  • Copy the record value from the Admin console. It is unique to your domain, so it cannot be shown here.
  • After you turn Gmail on, wait 24 to 72 hours before generating the key. After you add it to DNS, allow up to 48 hours before authentication starts working, then start it in the Admin console.
google._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=…key from the Admin console…"

Not sure which selector a message was signed with? See what is a DKIM selector.

DMARC

DMARC is a separate record that you publish yourself, at _dmarc under your domain. Start by only collecting reports, then tighten the policy once the reports show all your senders passing:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Replace the address with a mailbox you control. What is DMARC explains the policies, and how to read a DMARC report shows what to do with the reports.

Common problems

  • A second SPF record added next to an old one. Merge them into one record.
  • DKIM generated, but never started in the Admin console after the record was published.
  • The 2048-bit key pasted into a DNS host that silently cuts it at 255 characters. Check it with the DKIM checker and split the value if your host needs that.
  • Other services (a newsletter tool, a helpdesk) sending as your domain without their own include or DKIM key.

Failing messages are diagnosed in why DKIM or DMARC fails.

Sources

Values on this page come from the provider's own documentation, last checked on 8 November 2026. Providers change these settings, so confirm against the current page before you edit DNS:

Frequently asked questions

What is the SPF record for Google Workspace?

v=spf1 include:_spf.google.com ~all, as a TXT record at the root of your domain. If you also send through other services, add their include: entries to the same record.

What is the DKIM selector for Google Workspace?

The default selector is google, so the record is published at google._domainkey. You can choose another selector when you generate the key.

How long does Google Workspace DKIM take to start working?

After you add the key to DNS, allow up to 48 hours. If you have only just turned Gmail on, Google says to wait 24 to 72 hours before generating the key.

Do I need DMARC for Google Workspace?

Yes, it is a separate record you publish yourself. Start with p=none and a rua address, read the reports, then tighten the policy.