DMARC for mailbox providers

How do I set up DMARC for Google Workspace?

Google Workspace needs one SPF include on your domain and a DKIM key you generate in the Admin console. Mail is not signed with your domain until you turn that key on.

The DNS records for Google Workspace

SPF: TXT on your sending domain

v=spf1 include:_spf.google.com ~all

This is the record for a domain that sends only through Google. Add every other sender to this one record rather than publishing a second one.

DKIM selector: google

google._domainkey TXT (the public key from the Admin console)

google is the default prefix and you can change it. Choose a 2048-bit key unless your DNS host only supports 1024.

Values in angle brackets are specific to your account. Copy the real ones from Google Workspace rather than from this page.

Alignment caveats

✓Your domain's DKIM signature exists only after you generate the key, publish it and start authentication in the Admin console.
✓Other services that send as your domain are not covered by this record. Each one needs its own SPF or DKIM setup.
✓Google's page limits an SPF record to 10 include tags. Separately, the SPF standard (RFC 7208) allows 10 DNS lookups per check, and nested includes count towards that.

From p=none to p=reject with Google Workspace

Publish v=DMARC1; p=none; rua=mailto:<your-business-id>@mail.yourdmarc.online, or build it with the DMARC generator. Delivery does not change at this stage.
Add the records above, then verify them with the SPF checker and the DKIM checker, entering your selector.
Check that Google shows up as passing on both SPF and DKIM in your reports, then look for the other services sending as your domain. They are usually what fails.
Move to p=quarantine when your legitimate mail passes, and watch the reports for anything you missed.
Move to p=reject with sp=reject. Read the enforcement guide for what tends to break, and keep monitoring afterwards.

Sources

Taken from Google Workspace's own documentation, checked on 1 November 2026. Providers change these, so their setup screen wins over this page.

See how Google Workspace really does on your domain

Check a real message against the Gmail, Yahoo and Outlook.com sender rules, or test whether a stranger can send mail as your domain. Both are free.

Check a real message

Test for spoofing

Frequently asked questions

What SPF record does Google Workspace need?

v=spf1 include:_spf.google.com ~all, published as: TXT on your sending domain. This is the record for a domain that sends only through Google. Add every other sender to this one record rather than publishing a second one.

What DKIM selector does Google Workspace use?

google. google is the default prefix and you can change it. Choose a 2048-bit key unless your DNS host only supports 1024.

Will Google Workspace mail pass DMARC alignment?

Only once a passing SPF or DKIM result is on your From domain or its organizational domain. Your domain's DKIM signature exists only after you generate the key, publish it and start authentication in the Admin console.

How do I reach p=reject with Google Workspace?

Start at p=none with a rua address, finish the Google Workspace setup, then read your reports. Check that Google shows up as passing on both SPF and DKIM in your reports, then look for the other services sending as your domain. They are usually what fails. Move to p=quarantine, then p=reject, once your legitimate mail passes.

With yourDMARC, boosting email campaign deliverability, safeguarding brand identity, and fortifying business reputation is a breeze.

As a global team, we’re always available. Let’s talk!

Download to read the eBook

Get Support

Contact Now

Try yourDMARC