DNS guides

Setup guide

Google Workspace SPF, DKIM and DMARC setup

SPF, DKIM, DMARC and MX records for a Google Workspace domain: the exact values, where DKIM lives in the Admin console, and the order to set them up.

Set them up in this order: SPF and DKIM first, then DMARC, which relies on both. All are records at your DNS provider (where you bought the domain, or Cloudflare), not in Google Workspace.

1. SPF

One TXT record on the root of the domain. If other tools send as you, add their includes to this same record — a domain can have only one SPF record.

TXT · host @

v=spf1 include:_spf.google.com ~all

2. DKIM

The key is generated per domain, so copy it from Admin console → Apps → Google Workspace → Gmail → Authenticate email.

  1. Pick the domain and click Generate new record. Choose a 2048-bit key; keep the prefix selector google unless you already use it.
  2. Add the TXT record it shows at google._domainkey on your domain.
  3. Back in the Admin console, click Start authentication. It can take up to 48 hours before Google signs mail.

Record type: TXT. Not showing up? DKIM record not found.

3. DMARC

A TXT record at _dmarc. Start by monitoring with p=none and your own report address, then move to quarantine and reject.

TXT · host _dmarc

v=DMARC1; p=none; rua=mailto:[email protected]

4. MX

So replies to your outreach are delivered.

MX · host @

MX 1 smtp.google.com

Domains set up before 2023 may still list the five aspmx.l.google.com records; they keep working.

Questions

Which DKIM selector does Google use?

google, unless you changed the prefix when generating the key. The checker tries it by default.

I send through other tools too

Add each tool's include to the same SPF record and set up DKIM in each tool, so every sender passes DMARC.

Last checked 2026-10-21. Providers move their settings around; if a menu above has changed, search Google Workspace's admin help for “DKIM” or “SPF”.

Sending cold email? Outsquid re-checks these records for every sending domain every hour, so a broken one doesn't go unnoticed. How deliverability works