Patchkit

Setup guide

Google Workspace: SPF, DKIM and DMARC

Gmail for your domain. Google needs an SPF include, a DKIM key you generate in the Admin console, and a DMARC record.

DNS records to add

TXTHost@
v=spf1 include:_spf.google.com ~all

SPF: authorizes Google's servers to send as your domain

TXTHostgoogle._domainkey
<DKIM value from Admin console → Apps → Google Workspace → Gmail → Authenticate email>Get this value from your provider's dashboard.

DKIM: signs every message Google sends for you

TXTHost_dmarc
v=DMARC1; p=none; rua=mailto:<your report address>Get this value from your provider's dashboard.

DMARC: tells receivers what to do when checks fail

Steps

  1. If you already have an SPF record, add include:_spf.google.com to it instead of creating a second one.
  2. In the Google Admin console open Apps → Google Workspace → Gmail → Authenticate email, pick your domain and click Generate new record with a 2048-bit key.
  3. Publish the DKIM TXT record at google._domainkey, wait for DNS to update, then click Start authentication in the Admin console.
  4. Publish a DMARC record at _dmarc starting with p=none and move to quarantine and reject once reports look clean.

Good to know

  • Some DNS hosts limit TXT values to 255 characters. A 2048-bit DKIM key must then be split into several quoted strings in the same record.

Adding records at your DNS host

Cloudflare · Namecheap · GoDaddy · Amazon Route 53

Check your setup

After publishing, run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Google Workspace documentation.