Google Workspace SPF, DKIM and DMARC

Google Workspace sequence

First identify every sender, not only Gmail. Google's published Workspace SPF include covers Google-authorised sending but does not automatically cover a CRM, newsletter platform or web application. Publish one combined SPF record and verify a real message header.

In Google Admin, generate a DKIM record for the exact domain, publish the public key at the selector Google provides, then start authentication. Test by sending to a different account and inspect the original message for a DKIM pass.

After SPF and DKIM have been operating, publish DMARC in monitoring mode. Review reports, follow Google's current provider guidance and move to enforcement only after legitimate sources are understood and a rollback is recorded. Bulk senders must also follow Gmail's sender requirements, including appropriate unsubscribe functionality for subscribed mail.

Workspace verification worksheet

1. List Google Workspace and every non-Google sender using the domain.
2. Confirm the single SPF policy covers only authorised envelope senders.
3. Generate and publish the exact DKIM record shown in Google Admin, then start authentication.
4. Test a received message from each route for aligned SPF or DKIM.
5. Introduce DMARC reporting and investigate unknown or failing sources before enforcement.

Common incomplete setup

Publishing Google's SPF include does not authorise a separate website, CRM or newsletter system. Likewise, publishing a DKIM key does not prove that Google Admin has started signing outbound mail.