DMARC setup Google Workspace — SPF, DKIM, DMARC records for Gmail

If your business mail runs through Gmail with a custom domain, Google signs your mail with DKIM but you still have to publish SPF, DKIM and DMARC TXT records yourself at your DNS host. Google's admin rules (support.google.com/a/answer/81126) require senders of bulk mail to authenticate, so a domain with no DMARC can bounce or land in spam once volume grows.

Records Google Workspace, Gmail needs

Replace the placeholder parts (such as yourdomain.com or a generated key) with your own values. DKIM keys and subdomain CNAMES are never copied from a web page — generate yours in your own provider's console.

Merging SPF when you send from more than one source

Only ONE SPF record may exist per domain. If mail goes out through more than one service, the record carries a single v=spf1, one include: per source, and one -all (or ~all) at the end:

v=spf1 include:provider-a.com include:provider-b.net ~all

Each include costs one lookup and nested includes cost more; over 10 lookups receivers return PermError and treat your mail as if SPF failed entirely.

The 10-lookup limit

SPF counts every include:, a, mx, ptr, exists: and redirect= against a limit of 10 DNS lookups — and nested includes count too. Google Workspace, Gmail's include is one lookup, but every merge pushes you closer to the cap. Our free checker counts for you; our USD 24 report gives you a flattened record that stays under the limit.

Official documentation

1. Generate the DKIM key
2. Turn on DMARC
3. Set up SPF
4. Sender requirements for bulk mail
5. Add records at your DNS host

All links go to the provider's own docs; values in the table are examples, not copies of their pages.

Run your domain through the free checker before changing anything, so you know which records you already have.