Setting up SPF, DKIM and DMARC for Google Workspace: step by step
Email authentication for Google Workspace: the SPF record with _spf.google.com, generating and starting DKIM in the Admin console under Gmail → Authenticate email, the DMARC record as Google recommends — including wait times and the 2048-bit trap.
Google Workspace (Gmail with your own domain) requires the same three records as every provider, but creates none of them automatically. You set SPF and DMARC at your domain's DNS provider; DKIM you generate in the Admin console under Menu → Apps → Google Workspace → Gmail → "Authenticate email", enter the TXT record shown in DNS and then click "Start authentication". Google names three wait times: 24 to 72 hours after enabling Gmail before DKIM keys can be generated; up to 48 hours until SPF takes effect; 48 hours after SPF and DKIM before setting DMARC.
Step 1: SPF at the DNS provider
At the domain hoster (e.g. World4You, Strato, IONOS) create a TXT record on the domain — host @ or empty — with the value Google recommends for Workspace-only sending:
your-domain.comv=spf1 include:_spf.google.com ~allStep 2: Generate, enter and start DKIM
- In the Admin console (admin.google.com) via Menu → Apps → Google Workspace → Gmail → "Authenticate email".
- Select the domain and "Generate new record": key length 2048 bits (recommended) or 1024 bits if the DNS provider does not accept long TXT values; the prefix (selector) stays google by default.
- Create the TXT record shown at the DNS provider — host name google._domainkey, copy the value completely.
- Back in the Admin console click "Start authentication". Only then does Gmail sign your mail.
google._domainkey.your-domain.comv=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…Step 3: DMARC at the DNS provider
Google recommends setting DMARC only 48 hours after SPF and DKIM, starting with p=none and moving via quarantine to reject, staged via pct. Google's example additionally contains adkim=s and aspf=s (strict alignment) — for a start the relaxed default is enough:
_dmarc.your-domain.comv=DMARC1; p=none; rua=mailto:dmarc@your-domain.comStep 4: Check
Send an email to a private Gmail mailbox and open "Show original": spf=pass, dkim=pass with your domain and dmarc=pass is the goal. The DKIM status in the Admin console must show "Authenticating email". Anyone regularly sending larger volumes additionally registers the domain in the free Google Postmaster Tools — reputation and spam complaint rate are visible there.
Frequently asked questions
How do I set up DMARC for Google Workspace?
Create a TXT record under _dmarc.your-domain at the DNS provider, e.g. v=DMARC1; p=none; rua=mailto:dmarc@your-domain — according to Google only 48 hours after SPF and DKIM are in place. Then read reports and tighten via quarantine to reject.
Does this also apply to free @gmail.com addresses?
No — for @gmail.com Google manages authentication itself, there is nothing to set up. This article applies to your own domains in Google Workspace. Business mail from an @gmail.com address is a trust problem in itself anyway.
Why does my DKIM say "Not authenticating email"?
Usually the TXT record is not yet visible everywhere (Google quotes up to 48 hours, in practice mostly faster) — or it was truncated by the DNS form. Check the record from the outside, then click "Start authentication" again in the Admin console.
Why can't I generate a DKIM key yet?
Google requires a wait of 24 to 72 hours after enabling Gmail for the domain before the Admin console generates keys. Set SPF in the meantime — that needs no waiting.