Google Workspace DKIM, SPF and DMARC setup checklist

Google Workspace makes SPF and DKIM straightforward, but two of the three steps happen outside the Admin console, and the DKIM step has a "start authentication" button that is easy to miss. Here is the order that avoids surprises.

1. SPF

Add Google to the domain's single SPF record:

v=spf1 include:_spf.google.com ~all

If the domain already has SPF for other senders, add the include to that record rather than creating a second one. Two SPF records make SPF fail. Check the total stays under 10 lookups with the SPF lookup counter.

2. DKIM

1. In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
2. Pick the domain and choose Generate new record. Use a 2048-bit key unless the DNS host cannot store long TXT values. The default selector prefix is google.
3. Publish the TXT record it shows at google._domainkey. Long keys are split into several quoted strings by some DNS hosts; that is normal.
4. Wait for DNS (Google notes it can take up to 48 hours, usually much less), then return and click Start authentication. Until you do, Gmail keeps signing with its own domain.

3. DMARC

Publish at the DNS host:

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Start at p=none and read the reports to find every other sender (CRM, invoicing, newsletters). Move to quarantine and reject once they all pass with alignment. The stages are explained in DMARC p=none vs quarantine vs reject, and the reports in DMARC aggregate reports explained.

4. Verify

1. Send a message from the domain to an outside mailbox.
2. Open "Show original" in Gmail. You want SPF: PASS, DKIM: 'PASS' with domain example.com and DMARC: 'PASS'.
3. If DKIM shows a Google domain instead of yours, authentication has not been started yet.

Common problems

• DKIM record published but "Start authentication" never clicked. The most common gap on Workspace domains.
• A 1024-bit key left from years ago. Generate a 2048-bit key with a new selector, publish it, start authentication, then remove the old record after a few days.
• Secondary domains and aliases. Each domain that sends mail needs its own DKIM key and DMARC record.
• Groups and forwarding. Google Groups that rewrite messages can affect authentication for list mail. Watch the DMARC reports.

Then: encrypted delivery and sender rules

With SPF, DKIM and DMARC in place, add MTA-STS for mail coming in (see MTA-STS for Google Workspace) and check the domain meets the Google, Yahoo and Microsoft sender rules if it sends in volume.