dmarcexpert
All posts

How to set up DMARC for Google Workspace

Set up SPF, DKIM and DMARC for a Google Workspace domain: the SPF record, generating a 2048-bit DKIM key in the Admin console, timing, and the DMARC record.

By dmarc.expert

To get DMARC working on a domain that uses Google Workspace, publish an SPF record that includes Google, generate a DKIM key in the Admin console and publish it as a TXT record, turn on DKIM signing, then publish a DMARC record at _dmarc.yourdomain.com starting at p=none. The one step people miss is DKIM: Google does not sign mail with your domain’s key until you generate it and switch it on.

Step 1: SPF

SPF (Sender Policy Framework) lists the servers allowed to send mail for your domain. Google’s recommended record for a domain that only sends through Workspace is:

v=spf1 include:_spf.google.com ~all

Publish it as a TXT record at the root of your domain. Google recommends ~all (soft fail) rather than -all. With DMARC in place, the DMARC policy is what decides the outcome for failing mail, so ~all costs you nothing in protection.

A domain can only have one SPF record. If other services send as your domain, add their include: entries to this one record, and watch the 10 DNS lookup limit.

Step 2: DKIM

Without your own DKIM key, Google still signs your mail, but with a Google-owned domain. That signature does not align with your From address, so it does nothing for DMARC. Setting up your own key fixes that.

  1. In the Google Admin console, go to Menu, Apps, Google Workspace, Gmail, then Authenticate email.
  2. Select your domain and click Generate new record.
  3. Choose a 2048-bit key, which Google recommends. Only choose 1024-bit if your DNS host cannot store a 2048-bit key.
  4. Leave the prefix selector as google unless you already use that name for another key.
  5. Publish the record Google shows you as a TXT record at google._domainkey.yourdomain.com.
  6. Back in the Admin console, click Start authentication.

Two timing details trip people up:

  • A new Workspace account cannot generate a key straight away. After Gmail is turned on for the domain, Google says it can take 24 to 72 hours before you can get the DKIM key.
  • Signing does not start immediately. After you publish the key, it can take up to 48 hours for DKIM authentication to start working.

A 2048-bit key is too long for a single DNS string, so some DNS hosts ask you to split it into several quoted strings within one TXT record. That is normal and receivers join them back together. If your host mangles the key, the DKIM checker with selector google will tell you.

Step 3: DMARC

With SPF and DKIM working, publish a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

This turns on reporting without changing delivery. If you send reports to a monitoring service, make sure it has authorized your domain, otherwise receivers will discard the reports without telling you.

Give it a few weeks, read what the reports show, fix any failing senders, and then tighten in stages to p=quarantine and p=reject. Our guides to starting with p=none and moving to p=reject walk through each stage.

Other senders need their own setup

Google only authenticates mail that leaves through Gmail. Newsletters, invoices from your accounting system, helpdesk replies and CRM sequences all send as your domain separately. Each one needs its own DKIM records, set up in that service’s dashboard, so that its mail aligns with your domain. Your aggregate reports list every source, which makes them the best checklist of what still needs doing.

Check your work

Run your domain through the DMARC checker to confirm the policy and SPF, and the DKIM checker with the selector google to confirm your key is published and 2048-bit. Then send a message to an outside mailbox and check the headers: you should see dkim=pass with header.d=yourdomain.com, and dmarc=pass.