{"id":123,"date":"2026-07-02T01:18:42","date_gmt":"2026-07-02T01:18:42","guid":{"rendered":"https:\/\/mailjuke.com\/blog\/spf-dkim-dmarc-google-workspace-complete-guide\/"},"modified":"2026-07-02T01:18:42","modified_gmt":"2026-07-02T01:18:42","slug":"spf-dkim-dmarc-google-workspace-complete-guide","status":"publish","type":"post","link":"https:\/\/mailjuke.com\/blog\/spf-dkim-dmarc-google-workspace-complete-guide\/","title":{"rendered":"SPF, DKIM, and DMARC for Google Workspace: A Complete Setup Guide"},"content":{"rendered":"<p>SPF, DKIM, and DMARC are not optional extras for Google Workspace \u2014 they are how receiving servers decide whether mail from your domain is trustworthy. Get them wrong and even perfect copy lands in spam.<\/p>\n<h2>What each record actually does<\/h2>\n<ul>\n<li><strong>SPF<\/strong> lists which servers may send mail for your domain.<\/li>\n<li><strong>DKIM<\/strong> cryptographically signs messages so receivers can detect tampering.<\/li>\n<li><strong>DMARC<\/strong> tells receivers what to do when SPF\/DKIM fail, and where to send reports.<\/li>\n<\/ul>\n<h2>SPF for Google Workspace<\/h2>\n<p>Publish a single TXT record on the root domain. A clean starting point:<\/p>\n<pre>v=spf1 include:_spf.google.com ~all<\/pre>\n<p>Rules that save you later:<\/p>\n<ul>\n<li>Only one SPF record per domain name \u2014 merge includes instead of adding a second TXT.<\/li>\n<li>Stay under the 10-DNS-lookup limit. Too many third-party includes will fail SPF even when Google is correct.<\/li>\n<li>Use <code>~all<\/code> while testing, then move to <code>-all<\/code> once every legitimate sender is listed.<\/li>\n<\/ul>\n<h2>DKIM in Google Admin<\/h2>\n<ol>\n<li>Admin Console \u2192 Apps \u2192 Google Workspace \u2192 Gmail \u2192 Authenticate email.<\/li>\n<li>Select the domain \u2192 Generate new record (2048-bit when available).<\/li>\n<li>Publish the TXT host Google shows (often <code>google._domainkey<\/code>).<\/li>\n<li>Click Start authentication after DNS propagates.<\/li>\n<\/ol>\n<p>Rotate keys if a vendor ever had access to your DNS zone or if you inherited a domain with unknown history.<\/p>\n<h2>DMARC without breaking mail<\/h2>\n<p>Day one monitoring record:<\/p>\n<pre>v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1<\/pre>\n<p>After a week of clean reports:<\/p>\n<pre>v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com<\/pre>\n<p>Then raise <code>pct<\/code> and move to <code>p=reject<\/code> when aligned volume is stable.<\/p>\n<h2>Alignment: the detail most tutorials skip<\/h2>\n<p>DMARC requires the visible From domain to align with SPF or DKIM. If a marketing tool sends as <code>you@yourdomain.com<\/code> but signs as <code>vendor.com<\/code> without relaxed alignment, DMARC fails. Either:<\/p>\n<ul>\n<li>Send from a subdomain the vendor authenticates, or<\/li>\n<li>Configure the vendor to DKIM-sign as your domain.<\/li>\n<\/ul>\n<h2>How MailJuke helps<\/h2>\n<p>When you connect or register a domain in MailJuke, SPF, DKIM, and DMARC are part of the setup path \u2014 so authentication is live with your first inboxes, not a weekend project after the fact.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Publish the right SPF include, rotate DKIM keys in Admin Console, and move DMARC from monitoring to enforcement without breaking legitimate mail.<\/p>\n","protected":false},"author":1,"featured_media":124,"comment_status":"open","ping_status":"open","sticky":true,"template":"","format":"standard","meta":{"saved_in_kubio":false,"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[9,10,12],"tags":[],"class_list":["post-123","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-domain","category-email-deliverability","category-guide"],"_links":{"self":[{"href":"https:\/\/mailjuke.com\/blog\/wp-json\/wp\/v2\/posts\/123","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mailjuke.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mailjuke.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mailjuke.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mailjuke.com\/blog\/wp-json\/wp\/v2\/comments?post=123"}],"version-history":[{"count":0,"href":"https:\/\/mailjuke.com\/blog\/wp-json\/wp\/v2\/posts\/123\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mailjuke.com\/blog\/wp-json\/wp\/v2\/media\/124"}],"wp:attachment":[{"href":"https:\/\/mailjuke.com\/blog\/wp-json\/wp\/v2\/media?parent=123"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mailjuke.com\/blog\/wp-json\/wp\/v2\/categories?post=123"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mailjuke.com\/blog\/wp-json\/wp\/v2\/tags?post=123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}