This guide shows the DNS records Google Workspace needs so your email is authenticated: SPF, DKIM and DMARC. Use the exact values from your Google Workspace account where they differ — providers update them from time to time.
1. SPF record for Google Workspace
Add Google Workspace to your domain's SPF record. If you have no SPF record yet, create this TXT record on the root of your domain (host @):
v=spf1 include:_spf.google.com ~all
Already have an SPF record? Do not add a second one — insert include:_spf.google.com before the ~all / -all at the end of your existing record.
Use the SPF Generator to combine several services and the SPF Checker to confirm you stay under 10 DNS lookups.
2. DKIM for Google Workspace
In Google Workspace, follow this path and publish the record it shows:
- Google Admin console → Apps → Google Workspace → Gmail → Authenticate email → Generate new record (2048-bit) → add the TXT record at google._domainkey
- Click "Start authentication".
- Give DNS a few minutes, then confirm the record with the DKIM Checker.
The DKIM selector is usually google, so the record lives at google._domainkey.yourdomain.com. Enter that selector in the DKIM Checker to verify it.
3. DMARC
After SPF and DKIM pass, add a DMARC record so receivers know your policy and send you reports. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Then follow the step-by-step DMARC rollout to reach quarantine and reject safely.
4. MX records
To receive email with Google Workspace, your MX records must point to Google Workspace's servers (host names containing google.com, googlemail.com). Copy the exact values from your Google Workspace admin panel and check them with the MX Lookup.
Where to add the records
- Cloudflare — Cloudflare dashboard → select your domain → DNS → Records → Add record. For mail records keep the proxy (orange cloud) OFF.
- GoDaddy — GoDaddy → My Products → your domain → DNS → Manage DNS → Add New Record.
- Namecheap — Namecheap → Domain List → Manage → Advanced DNS → Add New Record. Use "@" for the root domain.
- Hostinger — Hostinger hPanel → Domains → your domain → DNS / Nameservers → Manage DNS records.
- Amazon Route 53 — AWS console → Route 53 → Hosted zones → your domain → Create record. Wrap TXT values in quotes.
Frequently asked questions
Do I need SPF, DKIM and DMARC for Google Workspace?
Yes. Gmail and Yahoo require SPF and DKIM plus DMARC for bulk senders, and authenticated mail is far less likely to land in spam.
Can I have two SPF records?
No. Two SPF records make SPF fail. Combine all services into one record.
How do I check that Google Workspace authentication works?
Run the Domain Checker, or send a message to Gmail and use "Show original" to see SPF, DKIM and DMARC results.
What is the DKIM selector for Google Workspace?
Usually "google" — but use the selector shown in your Google Workspace admin panel if it differs.