SPF record for Google Workspace

Google Workspace sends mail for your users, plus anything relayed through its SMTP relay. To send that mail as your domain and pass DMARC, publish the records below and check the alignment notes.

The SPF record

Add this include to the SPF record on your sending domain:

A complete record for a domain that sends only through Google Workspace:

This is the only Google include you need. When I last checked on 20 Aug 2026, _spf.google.com was flat, with only ip4: and ip6: terms, so the include cost one of your ten DNS lookups. Google can change the terms inside it without notice, so run the checker for the live number.

If you still have include:aspmx.googlemail.com in there from an older setup, delete it. It is a legacy alias and it is spending lookups you need.

Then count your lookups, because SPF allows ten DNS lookups across the whole chain of includes. A sender that receivers need an eleventh lookup to find gets a permerror and fails SPF, even though the record looks right when you read it. Run the domain through the SPF checker after every change. The count also moves when a provider changes its own records.

DKIM

Generate the key in the Admin console under Apps, Google Workspace, Gmail, Authenticate email. Choose 2048-bit, publish the TXT record it gives you at google._domainkey.example.com, then come back and press Start authentication.

Generating the key and turning on signing are separate buttons, so the key can sit correctly in DNS for months while Google signs nothing.

DMARC alignment with Google Workspace

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain while your mail fails DMARC.

• Mail your users send aligns on both SPF and DKIM out of the box, because the envelope sender is your domain and the signature uses it too.
• Mail an application sends through Google's SMTP relay service needs more work. The application's From domain has to be registered in the relay settings, and mail from an unregistered domain either gets rejected or goes out unaligned.
• Aliases and secondary domains each need their own DKIM key. One key on the primary domain does not cover the others.
• If a routing rule changes outbound content after Google has signed the message, the receiver sees a body hash failure.

The DMARC alignment guide covers the general case, and the dmarc=fail page shows how to read the Authentication-Results header.

Verification

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through Google Workspace to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. A test message shows what a receiver does with your mail. A DNS lookup only shows what you published.

Our SPF checker gives you the lookup count. The DKIM checker shows whether a selector resolves and whether the key is long enough, and the DMARC checker reads your policy back to you. You can use them free, without an account.

I checked the values here against Google Workspace's own documentation, at Google Workspace admin help. Providers change their DNS requirements without much notice. If their screen shows something different from this page, follow their screen and tell us.

A record can be correct and still fail alignment once real mail goes through it. Receivers record that result in the reports they send. We read the reports for you, and on a paid plan we email you the day a new sender fails. See whether this sender passes. Your first domain is free.