Google Workspace · SPF, DKIM, and DMARC
DMARC for Google Workspace: sign first, enforce second.
Google recommends configuring SPF and DKIM at least 48 hours before DMARC. The decisive checks are a real external message and a representative period of aggregate reports, not the TXT record alone.
Reviewed: July 19, 2026 · Primary sources below
Inventory Google and every third-party sender
Include Gmail plus newsletter, CRM, billing, support, website, and device senders. Each service eventually needs aligned SPF or DKIM for the visible From domain.
Check SPF for all legitimate sources
Publish exactly one policy. The example applies only when Google Workspace is your sole sender. Add third-party mechanisms according to their documentation; a second SPF record makes evaluation invalid.
v=spf1 include:_spf.google.com ~allGenerate DKIM in the Admin console
Open Apps, Google Workspace, Gmail, then Authenticate email. Select the domain and generate a record. Google recommends 2048 bits when the DNS provider supports it; the default selector is google.
google._domainkeyPublish the TXT record and start authentication
Copy the host and TXT value exactly to the DNS provider. After DNS is detected, return to the Admin console and select Start authentication. Publishing the key alone does not turn signing on.
Verify with an external test message
Send to a different Gmail or Workspace mailbox and inspect the original there. Google specifically advises against sending the test to yourself. Authentication-Results should show DKIM pass with alignment.
Roll out DMARC gradually
Wait at least 48 hours after SPF and DKIM, begin with p=none, and review reports daily. Google names one week as a typical baseline. Then test quarantine on a small percentage before moving toward reject.
v=DMARC1; p=none; rua=mailto:dmarc@example.comImportant
Publishing the DNS key does not mean DKIM is active.
You must explicitly start authentication in the Google Admin console after publishing the TXT record. Then verify a message received by an external mailbox. Increase DMARC enforcement only after headers and reports agree.
If you need continuous monitoring
See who really sends in your name.
DMARCTrust is an external platform for DMARC reports, alerts, and sender inventory. Its free evaluation tier is limited to one domain; paid business plans start at $19/month for two domains. The MX Audit score remains independent.
Do I need 2048-bit DKIM for Google Workspace?
Google recommends 2048 bits when your DNS provider supports the key length. A host with short TXT limits may require 1024 bits; copy Google's generated values exactly.
Why can I not generate a DKIM key yet?
Google documents a 24-to-72-hour wait after enabling Gmail before the Admin console may allow DKIM key generation.
How long should p=none run?
Google gives at least one week as a typical baseline and recommends daily report review. Rare monthly or campaign senders may require longer.
Can DMARC block legitimate Workspace mail?
Yes, when SPF or DKIM does not align with the visible From domain or a third-party sender is missing. That is why Google recommends monitoring first and then a small quarantine percentage.