How do I set up email authentication on Google Workspace?
Scott Anderson · Last reviewed
Short answer
Publish one SPF record containing include:_spf.google.com, generate and enable a DKIM key in the Google Admin console under Apps → Google Workspace → Gmail → Authenticate email, publish the resulting google._domainkey TXT record, then add a DMARC record at _dmarc with a reporting address. DKIM is not on by default and is the step most domains have never completed.
Key facts
Google Workspace generates a DKIM key on request, but signing must be switched on manually — new domains are not signing by default. Google Workspace DKIM help ↗
Google's default selector is 'google', so the published record lives at google._domainkey.yourdomain. Google Workspace DKIM help ↗
Google recommends a 2048-bit key where your DNS provider supports it. Google Workspace DKIM help ↗
Google Workspace is the easiest platform to get right and one of the most commonly left half-done. The SPF record usually gets published during setup, because mail doesn't work properly without it. DKIM is a separate screen that setup never forces you through, so it routinely sits untouched for years.
The checklist below takes about twenty minutes end to end, most of it waiting for DNS to propagate.
The records you need
Published at your DNS provider — the registrar or service hosting your domain, not in Google.
SPF — TXT at your root domain
v=spf1 include:_spf.google.com ~all
Add an include: for every other tool that sends as you, in this same record. Never a second record.
DKIM — TXT at google._domainkey
v=DKIM1; k=rsa; p=<the long key Google generates>
Google gives you the exact value to paste. Don't retype it.
DMARC — TXT at _dmarc
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1
Start at none with reporting, then move to quarantine and reject.
Turning on DKIM, which is the bit people miss
- 01
Open the admin console
admin.google.com, signed in as a super administrator. A normal user account can't do this.
- 02
Navigate to the authentication screen
Apps → Google Workspace → Gmail → Authenticate email. Google moves this around occasionally; searching the admin console for "authenticate" finds it.
- 03
Generate a new record
Choose your domain, select a 2048-bit key if your DNS host supports records that long, and generate. Google shows you a hostname and a value.
- 04
Publish it, then wait
Add the TXT record at your DNS provider. Google asks you to allow up to 48 hours before activating, though it's usually minutes.
- 05
Click Start authentication
This is the actual switch. Generating the key without returning to click this leaves you with a published key that signs nothing — a genuinely common half-finished state.
The mistakes that make it look done when it isn't
- Two SPF records
- Adding a second TXT record starting v=spf1 instead of merging into the existing one. Result: a permanent error, and receivers ignore SPF entirely.
- Key generated, authentication never started
- The record exists in DNS, so a checker reports DKIM present, but Workspace isn't signing anything.
- Old host still in SPF
- After migrating from a web host, the previous include: usually stays. It burns a DNS lookup and authorises a server you no longer control.
- Other senders forgotten
- Workspace is authenticated, but your invoicing, newsletter and website forms are not. Only the mail from those tools fails, which is why the symptom looks intermittent.
- DMARC never published
- SPF and DKIM pass, nothing ties them to the visible From: domain, and nobody is reporting on anything.
Worth doing while you're in there
Set up Google Postmaster Tools for your domain. It's free, it takes a DNS record to verify, and it shows you your spam complaint rate — the one number in Google's requirements that changes on its own without anyone touching a setting.
And check your MX records while you have the DNS panel open. Migrations frequently leave an old host's MX entry in place at a lower priority, quietly accepting a share of your incoming mail somewhere you no longer monitor.
Frequently asked
Do I need DKIM if I already have SPF through Google?
Yes. SPF breaks whenever your mail is forwarded, and forwarding is constant and invisible. DKIM survives it. Gmail's own requirements ask bulk senders for both, and there's no good reason for anyone else to run with one.
Does Google Workspace do DMARC for me?
No. DMARC is a record you publish in your own DNS; Google has no way to publish it on your behalf. Workspace does provide SPF and DKIM, which is what DMARC then checks alignment against.
What if my DNS provider won't accept a 2048-bit key?
Some older DNS panels can't store a TXT value that long. Google offers a 1024-bit option as a fallback, and Google's instructions cover splitting long values. Moving DNS to a provider that handles it properly — Cloudflare, for example — is usually the better answer.
How do I confirm it's actually working?
Send a message to an address on another provider, open the original message headers, and look for dkim=pass and spf=pass with your own domain. The checker on this site will also show whether the google._domainkey record is published.
Find out where your domain actually stands.
The checker reads your real records in a few seconds. The review works out whether they cover everything you send.