Many businesses find that their emails to customers don’t land in the primary inbox, often because DKIM, DMARC and SPF are set up incorrectly or skipped entirely. If your business uses Google Workspace, you should follow Google’s guidelines to make your emails more trustworthy. In this article, I’ll show you how to set up DKIM, DMARC and SPF for Google Workspace carefully, step by step. Let’s get started.
Why do we need DKIM, DMARC, and SPF?
I’ll explain this in simple terms, because technical jargon can be confusing if you’re new to this topic.
- DKIM: Helps Google verify whether your email is spoofed or actually authorized by the domain owner.
- DMARC: An email authentication protocol that protects your domain from unauthorized use and email spoofing.
- SPF: Helps Google block spam and detect whether the sender’s address is real or fake.
DKIM, DMARC and SPF help your outgoing emails reach the primary inbox. I talked to Google Workspace support, and they told me that setting up DKIM correctly helps reduce the number of emails that end up in spam.
How to check a domain's DKIM, DMARC and SPF
Go to the MX Check page to check if you have set up DKIM, DMARC, and SPF correctly. Paste your domain into the Domain name box and click Run test.
For example, lucidgen.com had yellow warnings for DKIM and DMARC, which meant DKIM and DMARC for Google Workspace weren’t set up correctly. Try running the test with your own domain to see the results.
After I fixed the DKIM and DMARC settings, the warnings disappeared and every check for lucidgen.com turned green. I’ll show you how to set up DKIM and DMARC right below.
Note: If you see a domain with many errors in the MX check that still gets its emails into the primary inbox, it probably doesn’t use Google Workspace. For example, a domain that uses Outlook will be set up according to Outlook’s requirements.
Set up DKIM, DMARC and SPF for Google Workspace
Set up DKIM for Google Workspace
To set up DKIM for Google Workspace, you need to use a super admin account in your (or your company’s) Google Workspace.
Step 1: Go to admin.google.com > search for DKIM in the search bar > click DKIM authentication.
Step 2: Click Generate new record > select the DKIM key length > click Generate.
- 1024-bit DKIM key: Compatible with more older email systems. Suitable for DNS providers that only accept values up to 255 characters. It’s the most widely used option, so for now I suggest choosing it.
- 2048-bit DKIM key: More secure and compatible with popular email systems such as Gmail and Outlook. Suitable for DNS providers that accept values longer than 255 characters. This is where things are heading.
Step 3: Copy the host name (google._domainkey) and the DKIM value to add to your DNS.
Step 4: Go to your domain management page > DNS settings > add the DKIM record as follows.
| Name | Type | TTL | Data |
|---|---|---|---|
| google._domainkey | TXT | 1h | Your DKIM key |
After you add the DKIM record to your DNS, Google says you need to wait up to 48 hours for it to take effect. It depends on your domain provider, but in my case it took about 30 minutes.
Step 5: After waiting 30 minutes to 48 hours, go back to the DKIM authentication page > click Start Authentication to verify that your domain has Google Workspace’s DKIM.
When the status changes to “Authenticating email”, the verification is successful.
If the verification fails and you get a message like the one below, wait the full 48 hours and click Start Authentication again.
Email authentication was not verified. Please allow 48 hours for DNS to update and make sure you entered the correct TXT record into your domain provider’s DNS settings page.
Error message when verifying DKIM
Set up DMARC for Google Workspace
Google suggests three common DMARC setups. Choose only one of them to add to your DNS.
| Name | Type | TTL | Data | Explanation |
|---|---|---|---|---|
| _dmarc | TXT | 1h | v=DMARC1; p=none; rua=mailto:reports@yourdomain.com | When a message fails authentication > Do nothing and deliver it to the recipient. Everything is logged and reported to you. |
| _dmarc | TXT | 1h | v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com | When a message fails authentication > Don’t deliver it and return it to the sender. You get a report. |
| _dmarc | TXT | 1h | v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com | When a message fails authentication > Mark it as spam and deliver it to the recipient’s spam folder. You get a report. |
I recommend starting with the first option (p=none) and watching the reports sent to your email for about 1 to 2 weeks. If any service sends mail on behalf of your domain (an email marketing tool, a CRM, your website…) and its SPF or DKIM isn’t set up correctly yet, jumping straight to p=reject would block those legitimate messages too. Once the reports show that your legitimate mail passes authentication, move to p=quarantine, and only then to p=reject for tight control over messages that fail authentication. This also follows Google’s recommended DMARC rollout.
Set up SPF for Google Workspace
Setting up SPF for Google Workspace is quite simple, with no options to choose from. Just add this TXT record to your DNS and you’re done.
| Name | Type | TTL | Data |
|---|---|---|---|
| @ | TXT | 1h | v=spf1 include:_spf.google.com ~all |
Note: An earlier version of this article also told you to add a record of type SPF (the screenshot below still shows that old setup). That record type has been discontinued under RFC 7208, so SPF should now be published as a TXT record only. If your domain already has a record starting with v=spf1, add include:_spf.google.com to that record instead of creating a second one, because a domain should have exactly one SPF record.
Conclusion
After setting up DKIM, DMARC and SPF, go back to Google’s Check MX page to see whether everything shows as valid. Feel free to share your results or questions in the comments below. Good luck!
