Trustliant
Sign inBecome a partner

Google Workspace email authentication, end to end

SPF, DKIM, and DMARC for a Google Workspace domain, in the order that keeps mail flowing at every step. Each step below is the exact record to publish — replace the placeholders with your domain's own values, and don't skip the monitoring period before enforcing anything.

Check your work with the free checkerBecome a founding partner

  1. 1Publish (or update) your SPF record

    SPF is a single TXT record at the root of your domain. If Google Workspace is your only sender, publish exactly the record below. If you already send mail through other platforms (a CRM, a marketing tool, a helpdesk), add include:_spf.google.com to your existing record instead of replacing it — SPF allows only one record per domain, and each include counts against the 10-lookup limit, so don't publish a second one.

    Host: yourdomain.com
Type: TXT
Value: v=spf1 include:_spf.google.com -all

  2. 2Generate and publish your DKIM key

    In the Admin console, go to Apps > Google Workspace > Gmail > Authenticate email, select your domain, and click Generate New Record. Choose a 2048-bit key if your DNS provider supports long TXT record values (most modern providers do) — fall back to 1024-bit only if it doesn't. Use the default google selector unless you have a reason to pick a custom one. Copy the generated value exactly; it's long and easy to truncate by accident.

    Host: google._domainkey.yourdomain.com
Type: TXT
Value: v=DKIM1; k=rsa; p=<public key value shown in the Admin console>

  3. 3Start DKIM authentication

    After the DNS record has had time to propagate (Google recommends waiting several hours, up to 48 for full effect), return to Authenticate email in the Admin console and click Start Authentication. Don't click it before the record is live — Google checks for the published key before turning signing on.

  4. 4Publish a DMARC record in monitoring mode

    Publish DMARC at p=none first, regardless of how confident you are — this collects aggregate reports without affecting delivery, so you can confirm every legitimate sender (including any tools outside Google Workspace) is passing before you enforce anything. Replace the rua= address with one you or your MSP actually monitors.

    Host: _dmarc.yourdomain.com
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:[email protected]

  5. 5Review aggregate reports, then move to enforcement

    Give it one to two weeks of aggregate reports (most receivers send daily). Look for any sending source that isn't passing SPF or DKIM alignment — that's either a tool you forgot about or a spoofing attempt, and you want to know which before you enforce. Once every legitimate sender aligns, move the policy up one step at a time and re-confirm reports after each change: first replace p=none with p=quarantine and watch for anything legitimate landing in spam, then replace p=quarantine with p=reject once quarantine has run clean.

Verify it worked

Run the free domain checker against the domain you just configured — it reads DMARC, SPF, DKIM, and BIMI back exactly as receivers see them, no email required.

Run a free domain check

Common questions

Why does Google recommend waiting before clicking Start Authentication?
DKIM authentication only works once Google's own servers can look up and confirm the public key you published. Clicking Start Authentication before the DNS record has propagated can result in signing failures until the record catches up — waiting a few hours (up to 48 to be safe) avoids the issue entirely.
What if I send mail through other tools besides Google Workspace?
Add each tool's SPF include to your single existing SPF record (never publish a second SPF TXT record), and confirm each tool separately supports DKIM signing with your domain — some do, some only sign with their own domain, which means you'll rely on SPF alignment for those instead.
Should I use a 1024-bit or 2048-bit DKIM key?
Use 2048-bit unless your DNS provider specifically can't handle long TXT record values — 1024-bit keys are considered weak by current standards and are only offered by Google as a compatibility fallback.

Managing this across a portfolio of client domains, not just one? That's what Trustliant is built for — every client's posture, scored and explained, under your brand.

See the MSP platform →