Guides › Providers
SPF, DKIM and DMARC for Google Workspace
SPF
Host: @ Type: TXT Value: v=spf1 include:_spf.google.com ~all
If you already have an SPF record, add the include to it rather than creating a second record. Two SPF records make SPF fail (see merging SPF records).
DKIM
In the Google Admin console go to Apps › Google Workspace › Gmail › Authenticate email, choose 2048-bit, and click Generate new record. Publish the TXT record it shows at google._domainkey (the default selector is "google"), wait for DNS to update, then click Start authentication. Many admins forget this last step, and Gmail doesn't sign mail until it's done.
DMARC
DMARC is set once per domain, not per provider. If you don't have one, start in monitoring mode:
Host: _dmarc Type: TXT Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Once the reports show all your legitimate mail passing, move to p=quarantine and then p=reject. See the rollout guide.
Use the checker to confirm all three records. It detects Google Workspace's DKIM selector automatically if it's a standard one.