Records to publish
Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Google Workspace account: copy it from Google Workspace's setup screen, which shows the exact record.
| For | Type | Host | Value |
|---|---|---|---|
| Domain verification | TXT | {domain} | google-site-verification={token}The 68-character value shown in the Admin console during sign-up. |
| Receiving mail | MX | {domain} | priority 1 · smtp.google.comSingle MX for new setups; domains set up before 2023 may still use the ASPMX values, which remain supported. |
| SPF | TXT | {domain} | v=spf1 include:_spf.google.com ~allIf the domain already has an SPF record, add the include to it; Google recommends ~all. |
| DKIM | TXT | google._domainkey.{domain} | {TXT record value from the Admin console}Generate it in Admin console > Apps > Google Workspace > Gmail > Authenticate email; google is the default selector. |
| DMARC optional | TXT | _dmarc.{domain} | v=DMARC1; p=none; rua=mailto:{report-address}Required for bulk senders of 5,000+ messages a day to Gmail; Google advises adding it 48 hours after SPF and DKIM. |
SPF
Publish v=spf1 include:_spf.google.com ~all as a TXT record at your root domain, or add the include to the SPF record you already have. Each subdomain that sends mail needs its own SPF record.
DKIM
One TXT record at google._domainkey.{domain}, generated per domain in the Admin console; its value starts with v=DKIM1. Use a 2048-bit RSA key, or 1024-bit only if your DNS host can't store 2048-bit keys. Rotation is manual: generate a new record, publish it, then start authentication again.
DMARC alignment
DKIM aligns: after you start authentication, Gmail signs with d={domain} using the google key. Google's bulk sender rules also require the From domain to align with SPF or DKIM.
Common mistakes
- After turning on Gmail, wait 24 to 72 hours before the Admin console lets you generate the DKIM key.
- Publish the TXT record first and only then click Start authentication; DKIM can take up to 48 hours to start working.
- A 2048-bit key is longer than the 255-character TXT string limit, so split it into several quoted strings, or use a 1024-bit key if your DNS host can't.
- Each domain and subdomain needs its own SPF record and its own DKIM key.
- Google's DMARC examples use strict alignment (adkim=s; aspf=s), which Google itself warns can reject or spam mail from your subdomains.
- Bulk senders (5,000+ messages a day to personal Gmail accounts) need SPF, DKIM and DMARC, with the From domain aligned to SPF or DKIM and DKIM keys of at least 1024 bits.
Check that it worked
DNS changes can take a few minutes to show. Then run the free checks, no account needed:
How EmailSecOps recognises Google Workspace
A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:
- SPF include, current or legacy: _spf.google.com
- Default DKIM selectors: google