Why do SPF, DKIM, and DMARC matter?
They matter because receiving mail servers use them to decide whether your mail can be trusted. Without them, attackers can more easily send mail that appears to come from your domain, and your own mail is more likely to land in spam. Gmail and other large mailbox providers now expect senders to authenticate their mail, especially senders who send in volume.
Set them up in order: SPF, then DKIM, then DMARC. If you are moving to Google Workspace, plan this work around your MX record cutover, since you will already be editing DNS. For how these records fit with your other security settings, see our Google Workspace security and HIPAA guide.
How do you set up SPF for Google Workspace?
You set up SPF by publishing one TXT record at the root of your domain that authorizes Google's mail servers. If Google Workspace is your only sender, the record is:
v=spf1 include:_spf.google.com ~all
Most organizations also send mail through other services, such as a website contact form, a billing system, or a newsletter tool. Each one has to be included in the same record.
- Publish only one SPF record per domain. Two SPF records cause failures.
- Add each sending service's include value, following that vendor's instructions.
- Stay within the SPF limit of 10 DNS lookups. Every include counts toward it.
- After your migration, remove the include for your old provider once nothing sends through it.
How do you turn on DKIM?
You turn on DKIM by generating a key in the Admin console, publishing it as a DNS TXT record, and then starting authentication. Until you do this, Gmail does not sign your messages with your own domain, which matters later for DMARC.
- In the Admin console, open the Gmail settings and find the email authentication section.
- Select your domain and generate a new record. Use a 2048-bit key if your DNS host supports it.
- Publish the TXT record at the host name Google shows, which is usually google._domainkey.
- Give DNS time to update, then return to the Admin console and start authentication.
Each domain you send from needs its own DKIM key. If you add a secondary domain later, repeat these steps for it.
How do you set up DMARC?
You set up DMARC by publishing a TXT record at the _dmarc host for your domain that states your policy and where to send reports. Start in monitoring mode, so nothing is blocked while you learn who sends mail as you:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Then tighten it in stages:
- Read the reports for a few weeks to find legitimate services that fail.
- Fix each one by adding it to SPF or setting up DKIM for it.
- Move the policy to p=quarantine, which sends failing mail to spam.
- Move to p=reject once you are confident every legitimate sender passes.
DMARC reports arrive as XML files that are hard to read by hand. A DMARC reporting service can turn them into something your team can use.
What goes wrong most often?
The most common problems are small DNS mistakes that are easy to fix once you know to look for them:
- Two SPF records on the same domain, often one left from the old provider
- A forgotten sending service, so invoices or form notifications start landing in spam
- Jumping straight to p=reject before reading any reports
- A DKIM record published in DNS but authentication never started in the Admin console
Email authentication protects your domain's reputation. It does not encrypt messages, which is a separate question covered in Is Gmail encrypted?. Both belong on your Google Workspace security checklist.
Next step
If you want these records set up correctly the first time, our HIPAA setup service includes email authentication, or you can contact us with questions.
Frequently asked questions
Will DMARC stop all phishing?
No. DMARC stops attackers from sending mail that uses your exact domain in the From address. It does not stop lookalike domains or mail from a compromised account. Pair it with 2-Step Verification and staff training on spotting suspicious messages.
Should our SPF record end in ~all or -all?
Many organizations start with ~all, which marks unlisted senders as suspicious without rejecting them outright. Once DMARC is enforcing a quarantine or reject policy, the DMARC policy does most of the work. Either ending is reasonable if your sender list is complete.
Do small organizations really need DMARC?
Yes. Attackers spoof small organizations too, often to send fake invoices to clients and vendors. A DMARC record costs nothing to publish, and starting in monitoring mode carries no risk to your mail while you learn who sends on your behalf.
