DMARC Setup for Google Workspace

The short answer: In Google Workspace, DMARC is a DNS TXT record you publish at _dmarc.yourdomain.com, not a setting in the Admin console. First confirm SPF includes _spf.google.com and turn on DKIM in Admin console > Apps > Google Workspace > Gmail > Authenticate email. Then publish v=DMARC1; p=none; rua=mailto:you@yourdomain.com, review reports, and tighten to quarantine and reject.

Before You Start: Will DMARC Break My Email?

Not if you start with p=none. That is monitoring mode: receivers send you reports and deliver everything as before. Only quarantine and reject change delivery, and you will not use them until the reports show your legitimate senders passing.

DMARC passes when SPF or DKIM passes and aligns with the domain in the visible From address. That is why Workspace needs both set up correctly first. If they are not, DMARC will report failures for your own mail.

Step 1: Check SPF Includes Google

Your SPF record is a TXT record at the root of your domain. For a domain that sends only through Google Workspace it should read:

v=spf1 include:_spf.google.com ~all

If you also send through other services (a CRM, newsletter tool, helpdesk), those must be added to the same record, and there must be only one SPF record in total. Test the current state with the SPF checker. The SPF generator can build a combined record, and the SPF syntax guide explains each mechanism.

Step 2: Turn On DKIM in the Admin Console

Google does not sign mail with your domain's own key until you enable it.

1. Sign in to the Admin console at admin.google.com as a super administrator.
2. Go to Apps > Google Workspace > Gmail.
3. Select Authenticate email.
4. Choose your domain from the drop-down if you have more than one.
5. Click Generate new record. Select the 2048-bit key length (use 1024 only if your DNS host cannot accept long TXT values) and keep the default selector google.
6. Copy the TXT record host and value Google displays. The host will be google._domainkey.
7. Add that TXT record at your DNS provider.
8. Wait for DNS to update, return to the same page, and click Start authentication.

The status should change to "Authenticating email with DKIM". Confirm it with the DKIM checker using selector google. Google's own guidance is to allow up to 48 hours after SPF and DKIM changes before you rely on them for DMARC.

If other platforms send as your domain, each needs its own DKIM setup. A mismatch there is the most common reason DMARC fails after Workspace is configured correctly.

Step 3: Create a Mailbox for Reports

Aggregate reports can be numerous, so avoid pointing them at your own inbox. Create either a dedicated user or a group:

• Group (recommended): Admin console > Directory > Groups > Create group, for example dmarc-reports@yourdomain.com. Add the people who will review reports as members. In the group's Access settings, set who can post to Anyone on the web, otherwise Google will reject reports sent from outside your organisation.
• User: Admin console > Directory > Users > Add new user. This consumes a licence.

If you will use a monitoring service, you will use its address instead (see Step 6).

Step 4: Publish the DMARC Record

Your DMARC record lives in DNS, wherever your domain's nameservers are managed. That might be Cloudflare, GoDaddy, Namecheap, Squarespace Domains (which took over Google Domains registrations) or your hosting provider. If you are unsure, the Admin console list of your domains is at Account > Domains > Manage domains, which shows the provider where you registered.

Create a TXT record:

What each tag does:

The DMARC record generator builds this record with the right syntax. Confirm it is live with the DMARC checker; it should show one record, p=none, and your rua address.

Step 5: Send Test Mail and Check Headers

Send a message from Workspace to a personal Gmail account. Open it, click the three dots, and choose Show original. You should see:

SPF:    PASS with IP 209.85.220.41
DKIM:   'PASS' with domain yourdomain.com
DMARC:  'PASS'

If DKIM shows your domain, DMARC passes through DKIM alignment, which is the most robust form. If you see DKIM: PASS with domain gappssmtp.com, DKIM is not yet enabled for your own domain. The email header analyzer and how to read email headers explain each field.

Step 6: Collect and Review Reports

Within a day or two, reports begin to arrive from large providers. You have two options:

• Read the XML yourself, as described in DMARC aggregate reports.
• Use a monitoring service that gives you its own rua address and shows senders in a dashboard. Best DMARC monitoring tools compares free and paid options. You can list your own mailbox and the service's address together, separated by a comma.

For each sender, ask whether it should be sending as your domain and whether it passes DMARC. Typical Workspace-adjacent senders to look for: Google itself, a marketing platform, a CRM, a helpdesk, an invoicing tool, a website form plugin, and printers or scanners.

The Staged Timeline to Enforcement

Spec update (May 2026): RFC 9989 obsoletes RFC 7489 and removes the pct tag used in the table below, adding a t=y test flag instead (the receiver applies one level below your published policy). Google and other receivers may still honour pct on existing records, but it is no longer part of the standard. If you want the same slow ramp without relying on it, hold each policy (quarantine, then reject) until your reports stay clean, and use t=y where your receivers support it.

Treat the dates as a minimum. If you send monthly invoices or quarterly newsletters, a four-week monitoring phase may not have exposed them yet. Move to the next row only when the previous stage's reports look clean.

A complete enforcement-stage record might look like this:

v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc-reports@yourdomain.com; adkim=r; aspf=r

adkim and aspf default to relaxed (r), which allows subdomains to align with the parent. Leave them alone unless you have a reason. Strict (s) alignment can break legitimate mail from subdomains. More on the reasoning at each level is in DMARC policy: none vs quarantine vs reject.

If you send more than 5,000 messages a day to Gmail users, Google's bulk sender rules require a published DMARC record regardless.

Secondary Domains, Aliases and Parked Domains

Workspace lets you add secondary domains and domain aliases under Account > Domains > Manage domains. Each one is a separate domain as far as DNS and DMARC are concerned, so each needs its own treatment:

• Domains that send mail: repeat Steps 1 to 5 for every domain. The DKIM drop-down in Authenticate email lists each domain separately, and each generates its own key.
• Domains that never send mail (parked, retired brands, typo-protection domains): publish a null SPF record and a reject policy immediately, because there is no legitimate mail to break:

yourdomain-old.com.          TXT  "v=spf1 -all"
_dmarc.yourdomain-old.com.   TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com"

• Subdomains inherit the parent's DMARC policy unless they publish their own _dmarc record or the parent sets sp=. If a vendor sends from news.yourdomain.com, check it passes before you enforce on the parent.

Sending reports for an extra domain to your main reporting mailbox needs the external authorisation record described in DMARC aggregate reports. It is not required when the reporting address is on the same domain as the record.

Troubleshooting

If You Are on Microsoft 365 Instead

The DMARC record is identical; only the SPF and DKIM steps differ. See email authentication for Microsoft 365. Comparing platforms? Google Workspace vs Microsoft 365 email security covers the authentication differences. If you are moving to Google, add DMARC as part of the migration checklist.

Frequently Asked Questions

Does Google Workspace set up DMARC automatically?

No. Google supplies SPF and DKIM tools in the Admin console but you must publish the DMARC TXT record yourself at your DNS provider.

Where do I find DMARC settings in the Google Admin console?

There are none. DKIM is under Apps > Google Workspace > Gmail > Authenticate email. DMARC is a DNS record, so it is managed where your domain's DNS is hosted.

Should I start with p=none in Google Workspace?

Yes. It collects reports without changing delivery. Move to quarantine and reject only after every legitimate sender passes.

How long does DMARC take to start working?

The record is usually visible within an hour but can take up to 48 hours. Reports typically start arriving within one to two days.

Can I roll back if mail starts bouncing?

Yes. Edit the TXT record at _dmarc.yourdomain.com and set the policy back to quarantine or none. Lowering the TTL to 300 before each change makes the rollback take effect in minutes rather than an hour.

Do I need DMARC if I only send a few emails?

Yes. DMARC protects your domain from being spoofed, and Gmail and Yahoo expect it from larger senders. Low volume does not stop someone using your name.

Next step: Verify what is live with the DMARC checker, or request a free email audit. If you would prefer a done-for-you rollout to p=reject, see the email security setup service.