Inboxpass All guides

Guides

DMARC setup for Google Workspace

26 October 2026

DMARC for Google Workspace is a DNS record, not an Admin console setting. Turn on DKIM in the Admin console, publish SPF with include:_spf.google.com, wait 48 hours, then add a TXT record at _dmarc.yourdomain.com starting with v=DMARC1; p=none and a reporting address. After a week or more of clean reports, tighten the policy.

Before you start

Google’s Set up DMARC page lists the prerequisites:

You will need access to two places: the Google Admin console as a super administrator, and the DNS settings at your domain host (often your registrar, or Cloudflare).

Step 1: SPF for Google

Google’s Set up SPF page gives this record for a domain that sends only through Google Workspace:

v=spf1 include:_spf.google.com ~all

Publish it as a TXT record with the host set to @. If other services send as your domain, add their includes to the same record. Google’s examples:

v=spf1 include:_spf.google.com include:amazonses.com ~all
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

One SPF record per domain. If you already have one, edit it. Google says SPF can take up to 48 hours to start working. Our guide on creating an SPF record covers the lookup limit and the choice between ~all and -all.

Step 2: DKIM for Google

This is the step people skip, and it is the one that makes Google Workspace mail pass DMARC reliably. From Google’s Set up DKIM page:

  1. In the Admin console, go to Menu, then Apps, Google Workspace, Gmail, and click Authenticate email.
  2. Select your domain and click Generate New Record.
  3. Choose 2048 bits if your DNS host supports it, otherwise 1024. Keep the prefix as google.
  4. Copy the host name (google._domainkey) and the TXT value (v=DKIM1; k=rsa; p=…).
  5. Add that TXT record at your DNS host.
  6. Once DNS has updated, return to Authenticate email and click Start authentication.

The status should read Authenticating email with DKIM. If you just added the domain to Google Workspace, Google says to wait 24 to 72 hours after turning on Gmail before generating the key. More detail is in our DKIM setup guide.

Step 3: Set up a place for reports

DMARC reports arrive as email, usually once a day from each provider that received mail from you. Google says large organizations can get hundreds or thousands a day. Google recommends sending them to a Google group or a dedicated mailbox, not your own inbox.

If the reporting address is on a different domain from the one you are protecting, that other domain has to agree to receive them. Google’s About DMARC reports page gives the format. To send reports for example.com to an address at reports.example.net, publish this on the receiving domain:

example.com._report._dmarc.reports.example.net  TXT  "v=DMARC1;"

The reports are XML. Google suggests a third-party DMARC service to collect and summarize them. You can also read them by hand with our guide to reading a DMARC report.

Step 4: Publish the DMARC record

Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

At your DNS host, create a TXT record:

Google’s rules for the record: v=DMARC1 must come first, followed by p. Other tags can follow in any order. Separate multiple rua addresses with commas, each starting with mailto:. Gmail ignores the ruf tag, so there is no point adding forensic reporting for Gmail’s sake.

Repeat for each domain you send from. Each domain can have its own policy and its own reporting address. Then confirm the record with a lookup:

dig TXT _dmarc.example.com +short

Step 5: Check your other senders

Google Workspace is rarely the only thing sending as your domain. Google’s DMARC page asks you to confirm with each third-party sender that SPF and DKIM are set up correctly for your domain. In practice:

Your first week of reports will show which sources you missed. Any IP you recognize that fails alignment is a setup task. Our guide to why DMARC fails covers the usual reasons.

Step 6: Tighten the policy

Google’s recommended rollout:

  1. Keep p=none for at least a week, reviewing reports daily. Google says a week is usually enough for the reports to cover all your mail streams.
  2. When the reports show no problems with your own mail, move to quarantine for a share of messages: 
    v=DMARC1; p=quarantine; pct=5; rua=mailto:dmarc-reports@example.com
    Google suggests choosing the starting percentage yourself, giving 10% for a small organization and 1% for a large one as examples.
  3. Raise pct over time until it reaches 100, still reading reports daily.
  4. Move to p=reject if you want failing mail refused instead of sent to spam.

The pct tag was dropped from the DMARC standard in May 2026, when RFC 9989 replaced RFC 7489, in favor of a t=y testing flag. Google’s page still documents pct. If you would rather not depend on it, move straight from none to quarantine once the reports are clean. Our guide to DMARC policies covers the trade-offs, including when to stop at quarantine.

Alignment settings

Leave adkim and aspf out unless you have a reason. Both default to relaxed, which lets mail.example.com align with example.com. Google says relaxed alignment usually gives enough protection, and suggests strict alignment only in cases like mail from a subdomain you do not control. It also warns that strict alignment can get legitimate subdomain mail rejected or sent to spam.

Check a message

Send a message from Google Workspace to a personal Gmail account, or any address outside your organization. Open it, choose More, then Show original. You want to see SPF, DKIM, and DMARC all passing, with DKIM showing your own domain. If the DKIM domain is not your own, Step 2 is not finished.

If something fails, Google’s DMARC troubleshooting page suggests pasting the header into the Google Admin Toolbox Messageheader tool, and using Email Log Search in the Admin console to look up messages by sender IP.

Mistakes to avoid

Sources