Set up SPF, DKIM and DMARC for Google Workspace

What it means

When you use Google Workspace, Gmail sends your emails, but your domain must prove it trusts Google. Three DNS records do that:

• SPF says Google's servers may send for your domain.
• DKIM adds a digital signature to each email, made with a key that only Google holds for your domain.
• DMARC tells receivers what to do when an email fails both checks, and sends you reports.

DKIM is not on by default for many Workspace domains: until you turn it on, Google signs with a generic Google domain, which does not count for your DMARC.

Why it matters

Gmail, Yahoo and Outlook expect senders to have SPF and DKIM, and bulk senders to also have DMARC. Missing pieces mean more emails in spam, and an easier life for people who fake your address.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. The SPF, DKIM and DMARC lines should all pass, and DKIM should show your own domain (d=yourdomain.com).
• Use the Domain scanner: type your domain at /domain-scanner to read your SPF and DMARC records without sending anything.

How to fix it

1. SPF

1. Log in to your DNS provider (where you bought the domain).
2. Look for an existing TXT record starting with v=spf1. You must have only one.
3. If none exists, add a TXT record on @:

v=spf1 include:_spf.google.com ~all

If you already have one for other tools, add include:_spf.google.com inside it instead of creating a second line.

2. DKIM

1. Open the Google Admin console and go to Apps, Google Workspace, Gmail, Authenticate email.
2. Select your domain and click Generate new record. Choose a 2048-bit key if your DNS provider accepts long values.
3. Copy the record: the name is google._domainkey and the value starts with v=DKIM1; k=rsa; p=.
4. Add it as a TXT record at your DNS provider.
5. Wait until it is visible (from a few minutes to 48 hours), then come back and click Start authentication.

3. DMARC

Add a TXT record named _dmarc. Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

The rua address receives daily reports from Gmail, Yahoo, Microsoft and others. Once every legitimate source passes, move to p=quarantine, then p=reject.

4. Other tools that send for you

Google Workspace only covers emails sent from Gmail. Your newsletter tool, shop, CRM or website form each need their own SPF include and DKIM records, or DMARC will fail for them.

Check that it is fixed

• Run the Domain scanner again: one SPF record, one DMARC record.
• Send a new test email from your Gmail account: SPF, DKIM and DMARC should all pass, with DKIM signed by your domain.
• With Delivmail DMARC monitoring in the paid dashboard, you can read the daily reports and spot any source still failing before you tighten your policy.

Official help: SPF, DKIM and DMARC for Google Workspace.