Email authentication
Google Workspace: SPF, DKIM and DMARC
The records Google Workspace documents for sending as your own domain. Each line links to Google Workspace's documentation; checked on 2026-10-19.
| SPF include | include:_spf.google.com, inside one TXT record such as "v=spf1 include:_spf.google.com ~all" support.google.com/a/answer/10685031 |
|---|---|
| DKIM | Generate the key in the Admin console (Apps › Google Workspace › Gmail › Authenticate email), publish the TXT record, then start authentication support.google.com/a/answer/174124 |
| DKIM selector | "google" by default; a different prefix can be chosen when generating the key support.google.com/a/answer/174124 |
| DKIM key length | 2048-bit recommended where the DNS host allows it support.google.com/a/answer/174124 |
| MX record | SMTP.GOOGLE.COM with priority 1 for new setups support.google.com/a/answer/140034 |
| Bulk senders | Senders of more than 5,000 messages a day to Gmail need SPF, DKIM and a DMARC record, aligned From domains and one-click unsubscribe support.google.com/a/answer/81126 |
Checked against Google Workspace's documentation on 2026-10-19. Providers change their instructions; the linked page is the authority.
DMARC, whichever provider you use
- Publish one TXT record at
_dmarc.yourdomain.com, starting withv=DMARC1; p=none; rua=mailto:…to collect reports. - When reports show only your own senders, move to
p=quarantine, thenp=reject. - DMARC passes when SPF or DKIM passes and aligns with the From domain, so sign with your own domain.
Check your domain in a few seconds
SPF, DKIM, DMARC and MX, with what to fix. Free, nothing stored.