Setup guide

Google Workspace: SPF, DKIM and DMARC

Gmail for your domain. Google needs an SPF include, a DKIM key you generate in the Admin console, and a DMARC record.

By Ahmet Karaca · Updated October 13, 2026 · Checked against Google Workspace documentation on October 13, 2026

DNS records to add

TXTHost@

v=spf1 include:_spf.google.com ~all

SPF: authorizes Google's servers to send as your domain

TXTHostgoogle._domainkey

<DKIM value from Admin console → Apps → Google Workspace → Gmail → Authenticate email>

DKIM: signs every message Google sends for you

TXTHost_dmarc

v=DMARC1; p=none; rua=mailto:<your report address>

Replace <your report address> with a mailbox you read, or with the report address Patchkit gives you when you add the domain.

DMARC: tells receivers what to do when checks fail

Steps

If you already have an SPF record, add include:_spf.google.com to it instead of creating a second one.
In the Google Admin console open Apps → Google Workspace → Gmail → Authenticate email, pick your domain and click Generate new record with a 2048-bit key.
Publish the DKIM TXT record at google._domainkey, wait for DNS to update, then click Start authentication in the Admin console.
Publish a DMARC record at _dmarc starting with p=none and move to quarantine and reject once reports look clean.

Common mistakes

Generating the DKIM key within 24–72 hours of turning on Gmail for the domain returns an error in the Admin console. Wait out that window, then generate the key again.
Google says not to click Start authentication until the google._domainkey TXT record is in DNS. Publish the record first, then turn signing on.
Publishing DMARC before SPF and DKIM are working leads to delivery issues, according to Google. Allow 48 hours after setting up SPF and DKIM before adding the _dmarc record.
Google warns that messages from a newly added mail server or third-party sender can be marked as spam until that sender is added to your SPF record.

Good to know

Some DNS hosts limit TXT values to 255 characters. A 2048-bit DKIM key must then be split into several quoted strings in the same record.

Frequently asked questions

Why does the Admin console still say my Google Workspace DKIM record needs updating?

The Admin console can keep showing that message for up to 48 hours even when the records are correct. DKIM itself can take up to 48 hours to start working after you add the key.

Do I need a separate DKIM key for each domain in Google Workspace?

Yes. Google requires a unique DKIM key from the Admin console for every domain you send from, and each domain also needs its own SPF record.

Should I choose a 1024-bit or 2048-bit key?

Google recommends 2048-bit because longer keys are more secure. Pick 1024-bit only if your DNS host doesn't support 2048-bit keys; you can upgrade later if it starts to.

Can I use a DKIM selector other than google?

Yes. google is the default prefix, but you can enter a different one when you generate the key, for example if your domain already uses the google selector.

Do my subdomains need their own DMARC record?

Not necessarily. Without an sp tag, subdomains inherit the parent domain's DMARC policy; Google documents sp for setting a different policy for them.

Adding records at your DNS host

Check your setup

After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Google Workspace documentation.

Check your Google Workspace setup

Or open the SPF checker, DKIM checker or DMARC checker directly.