Why this matters
Without these three records properly configured, your legitimate emails are far more likely to land in recipients’ spam folders — and your domain becomes an easier target for spoofing.
Setting up SPF
Add a TXT record at your domain root with this value (adjust if you send from other services too):
If you already have an SPF record, merge the include statement into your existing one — a domain can only have one SPF record.
Setting up DKIM
- In the Google Admin Console, go to Apps → Google Workspace → Gmail → Authenticate email.
- Generate a new DKIM key for your domain.
- Google provides a TXT record (host name typically google._domainkey) — add this exactly as shown to your DNS.
- Return to the Admin Console and click Start Authentication once the record has propagated.
Setting up DMARC
Add a TXT record at _dmarc.yourdomain.com with a value such as:
Start with p=quarantine (or even p=none for monitoring only) rather than jumping straight to p=reject, so you can review reports and confirm legitimate mail isn’t being blocked before tightening the policy.
Verifying your setup
Send a test email to a Gmail address and check “Show original” in the received message — it should show SPF: PASS, DKIM: PASS, and DMARC: PASS.
