Understanding Google Workspace (Gmail) Email Authentication
Google Workspace (formerly G Suite) requires domain administrators to authenticate outbound mail using SPF, DKIM, and DMARC. Messages sent without aligned authentication are automatically throttled, marked as spam, or rejected at receiving gateways.
When Google Workspace (Gmail) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Google Workspace (Gmail)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Google Workspace
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:_spf.google.com ~all | 3600 | Authorizes Google mail servers. |
| TXT | google._domainkey | v=DKIM1; k=rsa; p=MIIBIjANBgkqhki... | 3600 | Google 2048-bit public signature key. |
| TXT | _dmarc | v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com | 3600 | Enforces anti-spoofing policy. |
| MX | @ | smtp.google.com | 3600 | Incoming Google mail exchange. |
Step-by-Step Setup Instructions
Log into your DNS management portal (Cloudflare, GoDaddy, Namecheap, Route 53).
Locate your existing DNS records and check if a TXT record beginning with "v=spf1" already exists.
If an SPF record exists, merge Google by inserting "include:_spf.google.com" before the terminating "~all". Never create two separate SPF TXT records.
If no SPF record exists, create a new TXT record with Host "@" and Value "v=spf1 include:_spf.google.com ~all".
Navigate to Google Admin Console > Apps > Google Workspace > Gmail > Authenticate email to generate your 2048-bit DKIM key.
Add the generated DKIM TXT record at "google._domainkey.yourdomain.com" and click "Start Authentication" in the Admin Console.
Publish a DMARC TXT record at "_dmarc.yourdomain.com" with at least "v=DMARC1; p=quarantine;" or "v=DMARC1; p=reject;".
Common Google Workspace SPF Configuration Mistakes
× Multiple SPF TXT Records Published
Cause: Creating a second TXT record with include:_spf.google.com.
Fix: Merge into one record: "v=spf1 include:_spf.google.com ~all".
Frequently Asked Questions
What is the exact SPF include mechanism for Google Workspace?
The official SPF mechanism is "include:_spf.google.com".
Why does Google Workspace use include:_spf.google.com instead of a direct IP range?
Google's infrastructure uses thousands of dynamic sending IPs across global data centres. Delegating to _spf.google.com allows Google to update its authorized IP list without requiring any customer to change their DNS records.
What DKIM selector does Google Workspace use?
The default DKIM selector is "google" — the DNS record is published at google._domainkey.yourdomain.com as a TXT record containing the 2048-bit RSA public key generated in Google Admin Console.
Can I have both Google Workspace and another provider in the same SPF record?
Yes. Merge both includes into a single TXT record: "v=spf1 include:_spf.google.com include:otherprovider.com ~all". Never create two separate SPF TXT records on the same domain — RFC 7208 requires exactly one.
What DMARC policy does Google recommend for Workspace users?
Google recommends starting with p=none to monitor, then moving to p=quarantine, and finally p=reject once you confirm all legitimate sending sources pass SPF and DKIM. The recommended record is: v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; aspf=s; adkim=s
How do I verify my Google Workspace SPF record is working?
Use IncogSay's SPF Record Checker to perform a live DNS lookup of your TXT record. It will parse all mechanisms, flag any includes that fail to resolve, and count your DNS lookup usage against the RFC 7208 10-lookup limit.