SPF, DKIM and DMARC for Google Workspace: the exact records

1. SPF

Add (or edit) the single TXT record at your domain root that starts with v=spf1 so it reads: v=spf1 include:_spf.google.com ~all

If other services send email as you — a newsletter tool, a shop, invoicing — add their include to the same record. A domain must have only one SPF record.

2. DKIM

In the Google Admin console, open Apps → Google Workspace → Gmail → Authenticate email, generate a key, add the TXT record it shows to your DNS, then click Start authentication.

Google Workspace doesn’t sign mail with your own domain until you generate a DKIM key in the Admin console — until then Gmail signs as google.com, which doesn’t align for DMARC.

3. DMARC

Add a TXT record named _dmarc with v=DMARC1; p=none; rua=mailto:you@yourdomain.com, using a mailbox that exists. Read the daily reports for two to four weeks, then change p=none to p=quarantine so forged mail goes to spam.

Where to add the records

Menu names change, but these are the usual paths:

• GoDaddy: Sign in to GoDaddy → your domain → DNS → Add New Record.
• Cloudflare: Cloudflare dashboard → your domain → DNS → Records → Add record.
• Squarespace: Squarespace → Domains → your domain → DNS → DNS Settings → Add record.
• Namecheap: Namecheap → Domain List → Manage → Advanced DNS → Add New Record.
• IONOS: IONOS → Domains & SSL → your domain → DNS → Add record.
• STRATO: STRATO → Domains → Manage domain → DNS → manage the TXT and CNAME records.
• Wix: Wix → Domains → ⋯ next to your domain → Manage DNS Records → Add record.
• Hostinger: Hostinger hPanel → Domains → Manage → DNS / Nameservers → add a record.
• Amazon Route 53: AWS console → Route 53 → Hosted zones → your domain → Create record.
• Vercel: Vercel → Domains → your domain → DNS Records → Add.
• Hetzner: Hetzner DNS console → your zone → Add record.