Set up SPF, DKIM, and DMARC on Google Workspace
Google Workspace is the email host: you generate the DKIM key inside the Google Admin console, then publish SPF, the generated DKIM TXT, and DMARC at whatever DNS provider hosts your domain's records.
Where to add records on Google Workspace
Two different places. DKIM is GENERATED in the Google Admin console (admin.google.com): Menu (☰) > Apps > Google Workspace > Gmail, then click Authenticate email. But the actual SPF, DKIM, and DMARC TXT records are PUBLISHED at your domain's DNS host (your registrar or DNS provider, e.g. Cloudflare, GoDaddy, Namecheap, or Squarespace — which absorbed Google Domains), in that provider's DNS / DNS Records / Manage DNS area — NOT inside Google Admin. (Accessing Authenticate email requires the Gmail Settings admin privilege.)
- Decide which record you're adding (SPF and DMARC are authored by hand; the DKIM value must first be generated in the Google Admin console — see the DKIM note).
- Sign in to the control panel of the company that hosts your domain's DNS (usually your domain registrar), and open its DNS / DNS Records / Manage DNS / Zone Editor area.
- Add a new record with Type = TXT.
- Set the Host/Name field: use @ (or leave it blank) for the root-domain SPF record; use _dmarc for the DMARC record; use google._domainkey for the DKIM record (google is the default selector Google assigns).
- Paste the record value into the Value/Content/TXT data field (e.g. v=spf1 include:_spf.google.com ~all for SPF), leave TTL at the default (e.g. 3600), and Save.
- Wait for DNS propagation (often minutes, up to 48 hours), then verify — for DKIM, return to the Admin console Authenticate email page and click Start authentication once the record resolves.
The three records on Google Workspace
SPF Sender Policy Framework
Add ONE TXT record at the root domain. In the Host/Name field use @ or leave it blank (most providers treat blank as the apex). Value for Google-only sending: v=spf1 include:_spf.google.com ~all (Google recommends the ~all soft-fail). You may publish only one SPF (v=spf1) record per domain — if one already exists, merge include:_spf.google.com into it rather than adding a second SPF record, or mail will fail SPF.
DKIM DomainKeys Identified Mail
DKIM is GENERATED inside Google Workspace, not authored by you. In the Google Admin console go to Menu (☰) > Apps > Google Workspace > Gmail > Authenticate email, choose the domain in the Selected domain menu, and click Generate New Record (in the dialog keep the default prefix/selector \"google\" and 2048-bit key length — the recommended default; drop to 1024-bit only if your DNS host can't store long TXT values, then click Generate). Google then displays a TXT record under the labels \"DNS Host name (TXT record name)\" = google._domainkey (some DNS panels want the full google._domainkey, a few only take the selector \"google\" and auto-append \"._domainkey\") and \"TXT record value\" = v=DKIM1; k=rsa; p=<long-public-key>. Copy that into your DNS host. A 2048-bit key is long and may exceed a single 255-character DNS string — see the gotchas. After it propagates, return to the Authenticate email page and click Start authentication; the status at the top changes to \"Authenticating email with DKIM\". Note: Google Workspace DKIM is a TXT record, not a CNAME.
DMARC reporting and policy
Add a TXT record with Host/Name = _dmarc (your provider appends the domain, giving _dmarc.yourdomain.com). Start safely with v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com to collect reports, then tighten to p=quarantine and eventually p=reject once SPF and DKIM have been passing for at least 48 hours. Only set up DMARC AFTER both SPF and DKIM are authenticating, or you risk having legitimate mail quarantined/rejected.
Need the record values? Generate a valid SPF and DMARC record with the record generator, then learn what each one does: SPF, DKIM, DMARC.
Google Workspace gotchas
- DKIM lives in two systems: generating the key in the Admin console does nothing until you also publish the TXT at your DNS host AND click Start authentication afterward. Skipping that final Admin-console step leaves DKIM 'Not authenticating' even though the DNS record exists.
- 2048-bit DKIM keys often exceed the 255-character per-string DNS limit. Some DNS hosts auto-split the value into multiple quoted chunks for you; others require you to paste it as-is or manually split it into adjacent quoted strings — do NOT change the key text itself, and remove any spaces a copy/paste introduces into the p= value.
- Root vs blank: providers disagree on whether the apex SPF record wants @ or an empty Host field — using the wrong one can create a record at the literal name '@'. Check how existing root records are entered on your host.
- Only one SPF (v=spf1) TXT record is allowed per domain. Adding a second instead of merging into the existing one invalidates SPF for all senders.
- Some panels automatically wrap TXT values in quotes — if you paste a value that already has quotes you can end up with doubled quotes; paste the raw value and let the panel quote it.
- Propagation: Google says DKIM can take up to 48 hours to start authenticating; if Start authentication fails immediately, wait and retry rather than regenerating the key (regenerating creates a new key you'd have to re-publish).
Records set. Now make sure you actually land.
SPF, DKIM, and DMARC on Google Workspace get you authenticated, but inbox placement also needs sender reputation and domain warmup. Scheduler Zero handles both so your cold email reaches the inbox.