Setting up SPF, DKIM and DMARC on Google Workspace
Google Workspace gets you further by default than Microsoft — but "further" still is not aligned DKIM or any DMARC at all. Fifteen minutes in the Admin console and your DNS closes the gap.
The three records
SPF: v=spf1 include:_spf.google.com ~all — one record only; if something else already publishes v=spf1, merge, never add a second. DKIM: Admin console → Apps → Google Workspace → Gmail → Authenticate email → Generate new record (choose 2048-bit), publish the shown TXT at google._domainkey.yourdomain.dk, then click "Start authentication". Until you do, Google signs with a default key that does not align with your domain. DMARC: v=DMARC1; p=none; rua=mailto:reports@yourdomain.dk on _dmarc.yourdomain.dk, then follow the staged path to reject.
Keeping other senders aligned
The Workspace part is the easy 80%. The remaining 20% is every other tool sending as your domain — newsletters, webshop mail, invoicing systems. Each needs its own DKIM setup (usually CNAMEs the tool provides) so it signs as YOUR domain, and its include added to SPF if it uses your envelope domain. The DMARC reports arriving at your rua= address enumerate exactly which sources still fail — that is the to-do list.
Workspace-specific notes: Google routes bounce handling so SPF alignment normally holds for Gmail-originated mail; groups/forwarding can break SPF but DKIM survives, which is why the DKIM step is not optional; and if you migrated from another provider, check for leftover SPF includes and old selectors worth revoking. Verify the finished setup — record by record, selector by selector — with the free MonitorBase scan.
Free tools that help
- DKIM Inspector: Find published DKIM keys across common selectors and analyze key strength.
- DMARC Inspector: Parse and grade your DMARC policy, reporting addresses and alignment settings.