Are your Google Workspace emails going to spam, failing authentication, or getting rejected by recipients?
The problem may be related to your domain’s SPF, DKIM, or DMARC records.
These email authentication technologies help receiving servers verify whether messages are authorized to use your business domain.
Without proper configuration, even legitimate emails may be rejected or classified as suspicious.
In this guide, you’ll learn how SPF, DKIM, and DMARC work, how to configure them for Google Workspace, and how to troubleshoot common authentication errors.
Need help configuring your email authentication?
Adevcode offers professional DNS and Google Workspace email setup for small businesses.
Google Workspace DNS & Email Authentication Setup — Starting at $49
Get Professional SPF, DKIM & DMARC Setup →
What Are SPF, DKIM and DMARC?
SPF, DKIM, and DMARC are DNS-based email authentication technologies.
Although they work differently, their shared purpose is to help protect legitimate business email.
| Technology | Main Purpose |
|---|---|
| SPF | Identifies authorized email-sending servers |
| DKIM | Cryptographically signs outgoing messages |
| DMARC | Defines authentication alignment and handling policies |
For example, imagine someone attempts to send a fraudulent email claiming to originate from [email protected].
Email authentication helps receiving mail servers evaluate whether the message is legitimately associated with your domain.
These technologies cannot stop every phishing attempt, but they provide important protections against domain impersonation.
Why Email Authentication Matters for Google Workspace
Gmail has authentication requirements for messages sent to Gmail accounts.
Google recommends configuring SPF, DKIM, and DMARC for sending domains.
Bulk senders delivering more than 5,000 messages per day to personal Gmail accounts are subject to additional requirements, including SPF, DKIM, and DMARC.
Even small businesses benefit from configuring all three technologies correctly.
Authentication can help reduce the risk of messages being rejected because the receiving service cannot verify their origin.
However, correct authentication does not guarantee that every email will reach the inbox.
Sending reputation, message quality, user complaints, and other factors also matter.
Step 1: Check Your Existing DNS Records
Before adding new authentication records, inspect your domain’s current DNS configuration.
You can use:
- Your DNS provider’s management panel.
- Google Admin Toolbox.
- Public DNS lookup services.
Review existing TXT records, especially those containing:
v=spf1v=DKIM1v=DMARC1
Don’t delete existing records without understanding their purpose.
If your business uses multiple sending platforms, changing authentication records without planning can interrupt legitimate mail.
Step 2: Configure SPF for Google Workspace
SPF stands for Sender Policy Framework.
It identifies which sending systems are authorized to send email using your domain in the SMTP envelope.
Google Workspace SPF Record
If Google Workspace is your only service sending email for your domain, Google’s standard SPF record is:
v=spf1 include:_spf.google.com ~all
A typical DNS entry looks like this:
| Field | Value |
|---|---|
| Type | TXT |
| Name | @ |
| Value | v=spf1 include:_spf.google.com ~all |
Your DNS provider may use a different representation for the root domain.
How to Add the SPF Record
- Sign in to your DNS provider.
- Open the DNS management section.
- Look for an existing SPF record.
- If none exists, create a TXT record using Google’s recommended value.
- If SPF already exists, review it before making changes.
- Save the record.
- Check the published TXT record using a DNS lookup tool.
Can You Have Multiple SPF Records?
You should not publish multiple separate SPF records at the same hostname.
For example, creating independent records for Google Workspace and another mail provider can cause SPF evaluation errors.
Instead, the legitimate sending mechanisms normally need to be represented within one valid SPF policy.
What If WordPress Also Sends Emails?
If your website sends messages through a third-party email provider, that provider may need its own authentication configuration.
The correct solution depends on the actual sender, envelope domain, and DKIM signing domain.
Don’t simply copy a generic SPF record without considering all legitimate sending services.
Need help configuring SPF for multiple email services?
Request Professional DNS Configuration →
Step 3: Configure DKIM for Google Workspace
DKIM stands for DomainKeys Identified Mail.
It uses cryptographic signatures to help receiving servers verify outgoing messages.
For Google Workspace, DKIM configuration involves generating a signing key in the Google Admin Console and publishing the corresponding public key in DNS.
How to Generate a DKIM Key
- Sign in to the Google Admin Console.
- Navigate to Apps → Google Workspace → Gmail → Authenticate email.
- Select the domain you want to configure.
- Generate a DKIM authentication record.
- Choose a 2048-bit key where supported.
- Copy the TXT record name and value provided by Google.
For newly activated Gmail environments, you may need to wait before DKIM key generation becomes available.
Add the DKIM Record to DNS
Google will provide a hostname similar to:
google._domainkey
The TXT value typically begins with:
v=DKIM1; k=rsa; p=
The public key continues after p=.
Do not use a sample DKIM public key from an online tutorial. Your record must contain the key generated specifically for your Google Workspace domain.
Publish the record using your DNS provider’s dashboard.
Activate DKIM Signing
After the record becomes publicly visible:
- Return to the Google Admin Console.
- Select the configured domain.
- Start DKIM authentication.
- Allow time for the change to take effect.
- Send a test email and inspect its authentication results.
DKIM Not Working?
Common causes include:
- The TXT record was added to the wrong DNS zone.
- The hostname was entered incorrectly.
- The public key was truncated.
- DNS changes haven’t propagated.
- DKIM signing hasn’t been activated in Google Workspace.
If a receiving system reports dkim=fail, examine the actual message headers and verify that the signing domain and selector are correct.
Step 4: Configure DMARC for Google Workspace
DMARC stands for Domain-based Message Authentication, Reporting and Conformance.
It allows domain owners to establish policies for email that fails relevant authentication and domain alignment checks.
How DMARC Works
DMARC evaluates whether an email has a passing SPF or DKIM result aligned with the domain shown in the message’s visible From address.
At least one aligned authentication mechanism must pass for DMARC to pass.
Basic DMARC Record
A commonly used monitoring configuration is:
v=DMARC1; p=none
The corresponding DNS entry is:
| Field | Value |
|---|---|
| Type | TXT |
| Name | _dmarc |
| Value | v=DMARC1; p=none |
This example requests no DMARC-based enforcement from receivers. It does not provide aggregate reporting unless a reporting destination is configured.
Understanding DMARC Policies
Three commonly used DMARC policy values are:
p=none
Used for monitoring authentication without asking receiving systems to quarantine or reject failing messages.
p=quarantine
Requests that receivers treat messages failing DMARC as suspicious, often by placing them in spam or quarantine.
p=reject
Requests rejection of messages that fail DMARC authentication.
Should You Use p=reject Immediately?
Not usually, unless you’ve already verified that legitimate sending services are correctly authenticated and aligned.
A restrictive policy can affect legitimate business messages if your domain uses services that haven’t been configured properly.
For example, a company might use Google Workspace for employees but another platform for CRM notifications or website emails.
Before tightening DMARC enforcement, inventory all legitimate senders and review authentication results.
Step 5: Test SPF, DKIM and DMARC
After configuring your records, send a test email from your Google Workspace mailbox to an external Gmail account.
Open the received message.
In Gmail, select Show original from the message menu.
Review the authentication results.
A correctly authenticated message may show results such as:
spf=pass
dkim=pass
dmarc=pass
These are illustrative results. Actual values depend on the sending infrastructure and message headers.
What If SPF Passes but DMARC Fails?
SPF passing alone doesn’t guarantee DMARC passes.
The authenticated SPF domain must align with the visible From domain, or an aligned DKIM signature must pass.
If neither mechanism satisfies DMARC alignment, the message can fail DMARC even when SPF passes.
What If DKIM Fails?
Check whether the correct DKIM key is published and whether Google Workspace is actively signing messages for the domain.
Also confirm that the domain and selector in the email’s DKIM signature match your configuration.
What If Everything Passes but Emails Go to Spam?
Authentication isn’t the only factor affecting deliverability.
You may need to investigate:
- Sending domain reputation.
- Message content.
- Unusual sending patterns.
- Recipient engagement.
- Complaint and bounce rates.
- Third-party email platforms.
For a deeper troubleshooting guide, see:
Google Workspace Not Receiving Emails? 7 Ways to Fix It
SPF, DKIM and DMARC with Cloudflare
If Cloudflare hosts your domain’s DNS records, you can configure email authentication directly in the Cloudflare dashboard.
Sign in and select your domain.
Navigate to DNS management, then create or modify the required TXT records.
For example:
| Record | Hostname |
|---|---|
| SPF | @ |
| DKIM | google._domainkey |
| DMARC | _dmarc |
The exact DKIM value must come from your Google Workspace Admin Console.
If an SPF record already exists, review it rather than creating a duplicate.
Once the records are published, verify them using an external DNS lookup tool.
SPF, DKIM and DMARC for WordPress Websites
If your business uses WordPress, email authentication deserves special attention.
A WordPress website may send:
- Contact form notifications.
- WooCommerce order confirmations.
- Account registration messages.
- Password reset messages.
- Booking notifications.
These messages may be generated by an email service separate from Google Workspace.
Therefore, configuring Gmail authentication doesn’t necessarily authenticate outgoing mail sent through WordPress.
You may need a correctly configured SMTP service, API-based mail provider, or transactional email platform.
For a practical explanation, read:
WordPress Contact Form Not Sending Emails? Troubleshooting Guide
Professional SPF, DKIM and DMARC Setup — Starting at $49
Email authentication can become complicated when your domain uses multiple services.
At Adevcode, we provide technical setup and troubleshooting for small businesses using Google Workspace and WordPress.
Our services include:
- DNS record review.
- Google Workspace SPF configuration.
- Google Workspace DKIM configuration.
- Basic DMARC setup.
- Authentication testing.
- Troubleshooting common email configuration errors.
Basic Email Authentication Setup — Starting at $49
The introductory price covers a standard configuration for one domain.
Complex multi-provider environments, advanced DMARC deployment, and ongoing monitoring are quoted separately.
Get SPF, DKIM & DMARC Setup Help →
Frequently Asked Questions
What is the correct SPF record for Google Workspace?
If Google Workspace is your only email-sending service, the standard SPF value is v=spf1 include:_spf.google.com ~all.
Do I need DKIM if I already have SPF?
Both are recommended. DKIM provides signature-based authentication and can help establish DMARC alignment.
Is DMARC required for Google Workspace?
Google’s Gmail sender rules vary by sender category. Bulk senders to personal Gmail accounts must meet additional requirements, including DMARC. Google recommends configuring SPF, DKIM, and DMARC for sending domains.
Can SPF and DKIM both pass while DMARC fails?
Yes. DMARC also requires domain alignment. Passing authentication results alone aren’t sufficient if neither aligns with the visible From domain.
Can DMARC block legitimate emails?
Yes. Restrictive policies can interfere with legitimate messages if your sending services aren’t correctly configured.
Can Adevcode set up SPF, DKIM and DMARC?
Yes. Adevcode offers basic email authentication setup starting at $49, with complex configurations quoted individually.
Final Thoughts
SPF, DKIM, and DMARC are important components of a properly configured business email system.
Start by identifying all services that send email for your domain. Then configure SPF, enable DKIM signing, introduce an appropriate DMARC policy, and verify the results.
For the complete setup process, see our Google Workspace Business Email Setup Guide.
If you’d prefer professional assistance, Adevcode can help configure and troubleshoot your email authentication.
Professional Google Workspace Email Authentication Setup — Starting at $49
Request Technical Assistance →
Are your Google Workspace emails going to spam, failing authentication, or getting rejected by recipients?
The problem may be related to your domain’s SPF, DKIM, or DMARC records.
These email authentication technologies help receiving servers verify whether messages are authorized to use your business domain.
Without proper configuration, even legitimate emails may be rejected or classified as suspicious.
In this guide, you’ll learn how SPF, DKIM, and DMARC work, how to configure them for Google Workspace, and how to troubleshoot common authentication errors.
Need help configuring your email authentication?
Adevcode offers professional DNS and Google Workspace email setup for small businesses.
Google Workspace DNS & Email Authentication Setup — Starting at $49
Get Professional SPF, DKIM & DMARC Setup →
What Are SPF, DKIM and DMARC?
SPF, DKIM, and DMARC are DNS-based email authentication technologies.
Although they work differently, their shared purpose is to help protect legitimate business email.
| Technology | Main Purpose |
|---|---|
| SPF | Identifies authorized email-sending servers |
| DKIM | Cryptographically signs outgoing messages |
| DMARC | Defines authentication alignment and handling policies |
For example, imagine someone attempts to send a fraudulent email claiming to originate from [email protected].
Email authentication helps receiving mail servers evaluate whether the message is legitimately associated with your domain.
These technologies cannot stop every phishing attempt, but they provide important protections against domain impersonation.
Why Email Authentication Matters for Google Workspace
Gmail has authentication requirements for messages sent to Gmail accounts.
Google recommends configuring SPF, DKIM, and DMARC for sending domains.
Bulk senders delivering more than 5,000 messages per day to personal Gmail accounts are subject to additional requirements, including SPF, DKIM, and DMARC.
Even small businesses benefit from configuring all three technologies correctly.
Authentication can help reduce the risk of messages being rejected because the receiving service cannot verify their origin.
However, correct authentication does not guarantee that every email will reach the inbox.
Sending reputation, message quality, user complaints, and other factors also matter.
Step 1: Check Your Existing DNS Records
Before adding new authentication records, inspect your domain’s current DNS configuration.
You can use:
- Your DNS provider’s management panel.
- Google Admin Toolbox.
- Public DNS lookup services.
Review existing TXT records, especially those containing:
v=spf1v=DKIM1v=DMARC1
Don’t delete existing records without understanding their purpose.
If your business uses multiple sending platforms, changing authentication records without planning can interrupt legitimate mail.
Step 2: Configure SPF for Google Workspace
SPF stands for Sender Policy Framework.
It identifies which sending systems are authorized to send email using your domain in the SMTP envelope.
Google Workspace SPF Record
If Google Workspace is your only service sending email for your domain, Google’s standard SPF record is:
v=spf1 include:_spf.google.com ~all
A typical DNS entry looks like this:
| Field | Value |
|---|---|
| Type | TXT |
| Name | @ |
| Value | v=spf1 include:_spf.google.com ~all |
Your DNS provider may use a different representation for the root domain.
How to Add the SPF Record
- Sign in to your DNS provider.
- Open the DNS management section.
- Look for an existing SPF record.
- If none exists, create a TXT record using Google’s recommended value.
- If SPF already exists, review it before making changes.
- Save the record.
- Check the published TXT record using a DNS lookup tool.
Can You Have Multiple SPF Records?
You should not publish multiple separate SPF records at the same hostname.
For example, creating independent records for Google Workspace and another mail provider can cause SPF evaluation errors.
Instead, the legitimate sending mechanisms normally need to be represented within one valid SPF policy.
What If WordPress Also Sends Emails?
If your website sends messages through a third-party email provider, that provider may need its own authentication configuration.
The correct solution depends on the actual sender, envelope domain, and DKIM signing domain.
Don’t simply copy a generic SPF record without considering all legitimate sending services.
Need help configuring SPF for multiple email services?
Request Professional DNS Configuration →
Step 3: Configure DKIM for Google Workspace
DKIM stands for DomainKeys Identified Mail.
It uses cryptographic signatures to help receiving servers verify outgoing messages.
For Google Workspace, DKIM configuration involves generating a signing key in the Google Admin Console and publishing the corresponding public key in DNS.
How to Generate a DKIM Key
- Sign in to the Google Admin Console.
- Navigate to Apps → Google Workspace → Gmail → Authenticate email.
- Select the domain you want to configure.
- Generate a DKIM authentication record.
- Choose a 2048-bit key where supported.
- Copy the TXT record name and value provided by Google.
For newly activated Gmail environments, you may need to wait before DKIM key generation becomes available.
Add the DKIM Record to DNS
Google will provide a hostname similar to:
google._domainkey
The TXT value typically begins with:
v=DKIM1; k=rsa; p=
The public key continues after p=.
Do not use a sample DKIM public key from an online tutorial. Your record must contain the key generated specifically for your Google Workspace domain.
Publish the record using your DNS provider’s dashboard.
Activate DKIM Signing
After the record becomes publicly visible:
- Return to the Google Admin Console.
- Select the configured domain.
- Start DKIM authentication.
- Allow time for the change to take effect.
- Send a test email and inspect its authentication results.
DKIM Not Working?
Common causes include:
- The TXT record was added to the wrong DNS zone.
- The hostname was entered incorrectly.
- The public key was truncated.
- DNS changes haven’t propagated.
- DKIM signing hasn’t been activated in Google Workspace.
If a receiving system reports dkim=fail, examine the actual message headers and verify that the signing domain and selector are correct.
Step 4: Configure DMARC for Google Workspace
DMARC stands for Domain-based Message Authentication, Reporting and Conformance.
It allows domain owners to establish policies for email that fails relevant authentication and domain alignment checks.
How DMARC Works
DMARC evaluates whether an email has a passing SPF or DKIM result aligned with the domain shown in the message’s visible From address.
At least one aligned authentication mechanism must pass for DMARC to pass.
Basic DMARC Record
A commonly used monitoring configuration is:
v=DMARC1; p=none
The corresponding DNS entry is:
| Field | Value |
|---|---|
| Type | TXT |
| Name | _dmarc |
| Value | v=DMARC1; p=none |
This example requests no DMARC-based enforcement from receivers. It does not provide aggregate reporting unless a reporting destination is configured.
Understanding DMARC Policies
Three commonly used DMARC policy values are:
p=none
Used for monitoring authentication without asking receiving systems to quarantine or reject failing messages.
p=quarantine
Requests that receivers treat messages failing DMARC as suspicious, often by placing them in spam or quarantine.
p=reject
Requests rejection of messages that fail DMARC authentication.
Should You Use p=reject Immediately?
Not usually, unless you’ve already verified that legitimate sending services are correctly authenticated and aligned.
A restrictive policy can affect legitimate business messages if your domain uses services that haven’t been configured properly.
For example, a company might use Google Workspace for employees but another platform for CRM notifications or website emails.
Before tightening DMARC enforcement, inventory all legitimate senders and review authentication results.
Step 5: Test SPF, DKIM and DMARC
After configuring your records, send a test email from your Google Workspace mailbox to an external Gmail account.
Open the received message.
In Gmail, select Show original from the message menu.
Review the authentication results.
A correctly authenticated message may show results such as:
spf=pass
dkim=pass
dmarc=pass
These are illustrative results. Actual values depend on the sending infrastructure and message headers.
What If SPF Passes but DMARC Fails?
SPF passing alone doesn’t guarantee DMARC passes.
The authenticated SPF domain must align with the visible From domain, or an aligned DKIM signature must pass.
If neither mechanism satisfies DMARC alignment, the message can fail DMARC even when SPF passes.
What If DKIM Fails?
Check whether the correct DKIM key is published and whether Google Workspace is actively signing messages for the domain.
Also confirm that the domain and selector in the email’s DKIM signature match your configuration.
What If Everything Passes but Emails Go to Spam?
Authentication isn’t the only factor affecting deliverability.
You may need to investigate:
- Sending domain reputation.
- Message content.
- Unusual sending patterns.
- Recipient engagement.
- Complaint and bounce rates.
- Third-party email platforms.
For a deeper troubleshooting guide, see:
Google Workspace Not Receiving Emails? 7 Ways to Fix It
SPF, DKIM and DMARC with Cloudflare
If Cloudflare hosts your domain’s DNS records, you can configure email authentication directly in the Cloudflare dashboard.
Sign in and select your domain.
Navigate to DNS management, then create or modify the required TXT records.
For example:
| Record | Hostname |
|---|---|
| SPF | @ |
| DKIM | google._domainkey |
| DMARC | _dmarc |
The exact DKIM value must come from your Google Workspace Admin Console.
If an SPF record already exists, review it rather than creating a duplicate.
Once the records are published, verify them using an external DNS lookup tool.
SPF, DKIM and DMARC for WordPress Websites
If your business uses WordPress, email authentication deserves special attention.
A WordPress website may send:
- Contact form notifications.
- WooCommerce order confirmations.
- Account registration messages.
- Password reset messages.
- Booking notifications.
These messages may be generated by an email service separate from Google Workspace.
Therefore, configuring Gmail authentication doesn’t necessarily authenticate outgoing mail sent through WordPress.
You may need a correctly configured SMTP service, API-based mail provider, or transactional email platform.
For a practical explanation, read:
WordPress Contact Form Not Sending Emails? Troubleshooting Guide
Professional SPF, DKIM and DMARC Setup — Starting at $49
Email authentication can become complicated when your domain uses multiple services.
At Adevcode, we provide technical setup and troubleshooting for small businesses using Google Workspace and WordPress.
Our services include:
- DNS record review.
- Google Workspace SPF configuration.
- Google Workspace DKIM configuration.
- Basic DMARC setup.
- Authentication testing.
- Troubleshooting common email configuration errors.
Basic Email Authentication Setup — Starting at $49
The introductory price covers a standard configuration for one domain.
Complex multi-provider environments, advanced DMARC deployment, and ongoing monitoring are quoted separately.
Get SPF, DKIM & DMARC Setup Help →
Frequently Asked Questions
What is the correct SPF record for Google Workspace?
If Google Workspace is your only email-sending service, the standard SPF value is v=spf1 include:_spf.google.com ~all.
Do I need DKIM if I already have SPF?
Both are recommended. DKIM provides signature-based authentication and can help establish DMARC alignment.
Is DMARC required for Google Workspace?
Google’s Gmail sender rules vary by sender category. Bulk senders to personal Gmail accounts must meet additional requirements, including DMARC. Google recommends configuring SPF, DKIM, and DMARC for sending domains.
Can SPF and DKIM both pass while DMARC fails?
Yes. DMARC also requires domain alignment. Passing authentication results alone aren’t sufficient if neither aligns with the visible From domain.
Can DMARC block legitimate emails?
Yes. Restrictive policies can interfere with legitimate messages if your sending services aren’t correctly configured.
Can Adevcode set up SPF, DKIM and DMARC?
Yes. Adevcode offers basic email authentication setup starting at $49, with complex configurations quoted individually.
Final Thoughts
SPF, DKIM, and DMARC are important components of a properly configured business email system.
Start by identifying all services that send email for your domain. Then configure SPF, enable DKIM signing, introduce an appropriate DMARC policy, and verify the results.
For the complete setup process, see our Google Workspace Business Email Setup Guide.
If you’d prefer professional assistance, Adevcode can help configure and troubleshoot your email authentication.
Professional Google Workspace Email Authentication Setup — Starting at $49
