Google Workspace needs three things in your DNS: an SPF include, a DKIM key you generate in the Admin console, and a DMARC record. Until you do the DKIM step, Google signs your mail with a Google-owned domain instead of yours, so DKIM can't help it pass DMARC.
SPF
| Type | Name (host) | Value |
|---|---|---|
| TXT | @ | v=spf1 include:_spf.google.com ~all |
If you already have an SPF record for other tools, add include:_spf.google.com to it instead of creating a second record.
DKIM
- Sign in to the Google Admin console as a super administrator.
- Go to Menu > Apps > Google Workspace > Gmail and click Authenticate email.
- Pick your domain and click Generate new record. Choose a 2048-bit key; pick 1024 only if your DNS host can't store a 2048-bit key. Leave the prefix as
googleunless another key already uses it. - Copy the TXT record name and value Google shows. Don't click Start authentication yet.
- Add it at your DNS host:
| Type | Name (host) | Value |
|---|---|---|
| TXT | google._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqh... (the value Google shows) |
- Back in the Admin console, click Start authentication. Google says it can take up to 48 hours to start working.
Two timing gotchas. On a brand-new Workspace account, Google needs 24 to 72 hours after Gmail is turned on before it will generate a key. And some DNS hosts limit TXT record length; a 2048-bit key is longer than 255 characters, so the host has to split it into strings. Cloudflare, GoDaddy and Namecheap handle that for you.
DMARC
Once SPF and DKIM both pass, publish DMARC. Start at p=none with a report address you actually read:
| Type | Name (host) | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com |
After two to four weeks of clean reports, move to p=quarantine, then p=reject. The safe route to enforcement covers what to look for.
Other tools that send as you
Google's records only cover mail sent through Gmail. Your newsletter tool, CRM, invoicing or helpdesk each need their own domain authentication (usually DKIM CNAMEs) or their mail fails DMARC once you enforce. The DMARC reports show you which ones you've missed.
Questions people ask
How do I know DKIM is working?
Send a message to a Gmail address, open it, choose Show original, and look for DKIM: 'PASS' with your domain. Or run the checker with the selector google.
Do I need DKIM for each Google domain alias?
Yes. Every domain you send from needs its own DKIM key and DMARC record; generate one per domain in the same Admin console screen.
Related guides
- How to find your DKIM selector Read it from a message header in a minute, then check the key.
- Moving DMARC from p=none to reject without losing mail The order of steps, how long to wait, and what to look for first.
- SPF too many DNS lookups: how to get under 10 Which terms count, how to count nested includes, and five ways to get under 10.
DNS only shows part of the picture. If mail is still landing in spam with every record right, the deliverability audit looks at the rest: blocklists, reputation, bounces, content and the sending setup.