Google Workspace - SPF & DKIM Configuration

🎧 Prefer to listen? Hit play to hear this article read aloud.

---

Google Workspace - SPF & DKIM Configuration

Introduction

Google Workspace provides the email infrastructure behind Gmail and other Google productivity tools. Setting up email authentication helps receiving mail servers verify that your messages are coming from an authorized sender.

This guide walks you through SPF and DKIM configuration for Google Workspace. The two records are configured separately, so you can complete and verify each authentication method independently.

---

Google Workspace SPF Configuration

SPF (Sender Policy Framework) tells receiving mail servers which services are allowed to send email on behalf of your domain.

For Google Workspace, the SPF record uses the following Google include: include:_spf.google.com

---

Check Whether Your Domain Already Has an SPF Record

Before creating an SPF record, check your domain's DNS settings.

If your domain already has an SPF record, do not create a second one. Add Google's include to the existing SPF record instead.

For example: v=spf1 include:_spf.google.com include:_spf.intacct.com include:spf.protection.outlook.com ~all

---

Create an SPF Record If You Don't Have One

If your domain doesn't have an SPF record yet, create a new TXT record in your DNS provider. For Google Workspace, the record should include:

v=spf1 include:_spf.google.com ~all

You can also use the Warmy SPF Record Generator to generate an SPF record and help avoid syntax errors.

When using the generator, enter your domain, select Gmail, and generate the record.

---

Publish the SPF Record in DNS

Copy the generated SPF record and add it to your domain's DNS zone as a TXT record. The exact fields and names can vary depending on your DNS provider.

---

Verify Your SPF Configuration

After publishing the TXT record, allow time for the DNS changes to propagate.
You can then use an SPF lookup or email authentication testing tool to verify that your domain's SPF record contains: include:_spf.google.com

Your SPF setup is complete once the record is published correctly and can be found in DNS.

---

Google Workspace DKIM Configuration

DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing messages. Receiving mail servers can use this signature to verify that the message was sent by an authorized system.

Google Workspace generates the DKIM key for your domain. You then publish the generated public key in your DNS and enable DKIM authentication in the Google Admin Console. Google recommends using a 2048-bit DKIM key when your DNS provider supports it.

Open the Google Admin Console

Sign in to the Google Admin Console with an administrator account.
Then go to: Apps → Google Workspace → Gmail → Authenticate email

---

Select Your Domain

On the Authenticate email page:
1. Select the domain you want to configure.
2. Click Generate New Record.

If you manage multiple domains, make sure you select the domain that sends your Google Workspace email.

---

Generate the DKIM Record

In the DKIM configuration window:
1. Select 2048-bit for the DKIM key length when available.
2. Enter a unique selector name.
3. Click Generate.

Google Workspace will generate the DNS information you need to publish.

---

Add the DKIM TXT Record to Your DNS

Copy the DKIM TXT record generated by Google Workspace.
Then open your domain's DNS management page and create a new TXT record.

Add the values provided by Google:

• Host/Name: The DKIM record name provided by Google.

• Value: The complete DKIM TXT value generated by Google.

Save the DNS record.

---

Wait for DNS Propagation

After publishing the DKIM TXT record, allow time for the DNS change to propagate. The record must be available in DNS before Google Workspace can verify it.

---

Return to Google Admin Console and Start Authentication

Once the DKIM TXT record has been published:

1. Return to the Google Admin Console.
2. Go to Apps → Google Workspace → Gmail → Authenticate email.
3. Select the domain you configured.
4. Click Start Authentication.

Google Workspace will check the DNS record and enable DKIM signing for the domain. Google documentation and support guidance use Start Authentication to begin DKIM signing after the DNS record has been published.

---

Confirm That DKIM Is Active

If the configuration is successful, the DKIM status will indicate that authentication is active.

The button will change from: Start Authentication to: Stop Authentication.
This indicates that DKIM signing has been enabled for the selected domain.

---

Verify DKIM on a Sent Email

After DKIM is enabled, send a test email from your Google Workspace account to another email address.

For Gmail or Google Workspace recipients, you can open the message headers and check the Authentication-Results section.

A successful DKIM check should show a result similar to: DKIM=pass

Google recommends checking the message headers to confirm that DKIM signing is working.

---

Expected Result

After completing both configurations:

• Your domain has a valid SPF record that authorizes Google Workspace to send email.
• Your domain has a DKIM TXT record published in DNS.
• DKIM authentication is enabled in Google Workspace.
• Outgoing Google Workspace messages can be authenticated using SPF and DKIM.
• Your domain is better protected against spoofing and unauthorized email sending.

Proper email authentication also supports Google's sender requirements and can help improve the reliability of email delivery.