Google Workspace DNS Records: MX, SPF, DKIM, DMARC

Where is your domain's DNS managed?

Each guide below uses that host's field names, steps and known problems.

These are the values for any DNS host. Field names differ between hosts, so use the host guides above for the exact boxes to fill in.

Record	Type	Host / Name	Value	Priority	TTL
Domain verification Proves you own the domain	Type	TXT	Host / Name	`@`	Value	Copy from Google Admin console Looks like: google-site-verification= followed by your unique code	Priority	n/a	TTL	Default
MX records Where incoming email goes	Type	MX	Host / Name	`@`	Value	`smtp.google.com`	Priority	1	TTL	Default
SPF record Which servers may send as you	Type	TXT	Host / Name	`@`	Value	`v=spf1 include:_spf.google.com ~all`	Priority	n/a	TTL	Default
DKIM A signature on every message	Type	TXT	Host / Name	`google._domainkey`	Value	Copy from Google Admin console	Priority	n/a	TTL	Default
DMARC record What to do with fakes · recommended	Type	TXT	Host / Name	`_dmarc`	Value	`v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com`	Priority	n/a	TTL	Default

What Google Workspace's documentation says about each record, in one place.

Leave the host blank or enter @.
Once Google has verified the domain, this TXT record can be safely removed. Removing it earlier makes verification fail.
It can take up to 72 hours for a new TXT record to be recognized.

Remove any other MX records. Email might not work correctly if old or incorrect MX records stay in place.
Some domain hosts need a trailing period: smtp.google.com.
Accounts that started before 2023 may use older values beginning with aspmx. Those are still supported, so there is no need to change working records.
For TTL, use your domain host's default.

If other services also send email for your domain, list each one in the same record, for example: v=spf1 include:_spf.google.com include:amazonses.com ~all.
This is the record for domains that send email only through Google Workspace.
Google recommends ~all at the end of the record.

After the record is published, go back to Authenticate email and turn on authentication for the domain.
google is Google's default selector, so the host is google._domainkey.
Wait 24 to 72 hours after turning on Gmail before generating the key.
Some domain hosts limit TXT record length. If the 2048-bit key will not fit, generate a 1024-bit key instead.

Start with p=none so nothing is blocked while you read the reports. Google suggests running it for about a week.
Replace the report address with a mailbox or group you actually check. Google advises against a personal inbox.
Then tighten step by step: change p=none to p=quarantine, and later to p=reject, reading the reports after each change.
Set up SPF and DKIM first. Google recommends 48 hours of authentication before turning on DMARC.

Leaving old MX records in place

Google says email might not work correctly if old or incorrect MX records stay. Remove every MX record except smtp.google.com.

Adding a second SPF record

A domain must have only one SPF record. If you already have one, add include:_spf.google.com to it instead of creating another.

Generating the DKIM key too soon

Google asks you to wait 24 to 72 hours after turning on Gmail before generating the DKIM key.

Publishing DKIM but not turning it on

Adding the TXT record is only half the job. Go back to Authenticate email in the Admin console and turn on authentication.

Deleting the verification record too early

Removing the google-site-verification record before Google confirms the domain makes verification fail.

Enter your domain to see which records are in place.