Understanding Google Workspace (Gmail) Email Authentication
Google Workspace (formerly G Suite) requires domain administrators to authenticate outbound mail using SPF, DKIM, and DMARC. Messages sent without aligned authentication are automatically throttled, marked as spam, or rejected at receiving gateways.
When Google Workspace (Gmail) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Google Workspace (Gmail)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Google Workspace
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:_spf.google.com ~all | 3600 | Authorizes Google mail servers. |
| TXT | google._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqhki... | 3600 | Google 2048-bit public signature key. |
| TXT | _dmarc | v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com | 3600 | Enforces anti-spoofing policy. |
| MX | @ | smtp.google.com | 3600 | Incoming Google mail exchange. |
Step-by-Step Setup Instructions
Log into your DNS management portal (Cloudflare, GoDaddy, Namecheap, Route 53).
Locate your existing DNS records and check if a TXT record beginning with "v=spf1" already exists.
If an SPF record exists, merge Google by inserting "include:_spf.google.com" before the terminating "~all". Never create two separate SPF TXT records.
If no SPF record exists, create a new TXT record with Host "@" and Value "v=spf1 include:_spf.google.com ~all".
Navigate to Google Admin Console > Apps > Google Workspace > Gmail > Authenticate email to generate your 2048-bit DKIM key.
Add the generated DKIM TXT record at "google._domainkey.yourdomain.com" and click "Start Authentication" in the Admin Console.
Publish a DMARC TXT record at "_dmarc.yourdomain.com" with at least "v=DMARC1; p=quarantine;" or "v=DMARC1; p=reject;".
Common Google Workspace SPF Configuration Mistakes
× Multiple SPF TXT Records Published
Cause: Creating a second TXT record with include:_spf.google.com.
Fix: Merge into one record: "v=spf1 include:_spf.google.com ~all".
Frequently Asked Questions
What is the exact SPF include mechanism for Google Workspace?
The official SPF mechanism is "include:_spf.google.com".