Skip to content

How to set up DMARC for Google Workspace

By Ash, Founder, HosteazePublished 2 min read

The short answer

First make sure SPF includes _spf.google.com and DKIM is switched on in the Google Admin console. Wait 48 hours, then add a TXT record at _dmarc on your domain with the value v=DMARC1; p=none; rua=mailto: followed by a reporting address. Read the reports for a few weeks before moving to quarantine.

An old iron key in a rustic wooden door lock
Credit: makamuki0 via Pixabay

If your business email runs on Google Workspace, Google does most of the hard work. It sends your email from servers already covered by its SPF record, and it signs it with DKIM once you switch that on. DMARC is the last step, and it's the one Google can't do for you, because it's a record in your own domain's DNS.

What has to be in place first?

DMARC only works if your email already passes SPF or DKIM. Check both before you start.

  1. SPF: your domain needs one TXT record starting v=spf1 that includes include:_spf.google.com, for example v=spf1 include:_spf.google.com ~all. Add an include for any other service that sends as your domain.
  2. DKIM: sign in to the Google Admin console and go to Apps > Google Workspace > Gmail > Authenticate email. Generate a key, add the TXT record Google shows you (its name starts google._domainkey) to your DNS, then come back and click Start authentication.

Google recommends waiting 48 hours after setting up SPF and DKIM before you add DMARC.

How do I add the DMARC record?

  1. Create a mailbox or group to receive reports, such as dmarc@yourdomain.co.uk.
  2. Open your domain's DNS settings, wherever your DNS is managed.
  3. Add a TXT record with the host set to _dmarc. Some panels want the full name, _dmarc.yourdomain.co.uk.
  4. Set the value to v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk.
  5. Save, then check your domain has DMARC once the change has spread.

Google's own example record also sets adkim=s; aspf=s (strict alignment). Leave those out to begin with. The default relaxed setting is more forgiving of subdomains and suits most small businesses.

How do I check Google is passing DMARC?

Send an email from your Workspace account to a personal Gmail address, open it, choose Show original, and look for DMARC: PASS. Then do the same from every other tool that sends as your domain, such as your newsletter platform, booking system or website forms.

When should I move beyond p=none?

When the reports show every legitimate sender passing, usually after two to four weeks. Then move to p=quarantine, and later p=reject. DMARC p=none vs quarantine vs reject has a safe step-by-step order. For the bigger picture across all three records, see how to set up SPF, DKIM and DMARC.

Step by step

  1. 1.Check SPF

    Make sure your domain has one SPF record that includes include:_spf.google.com.

  2. 2.Turn on DKIM

    In the Google Admin console, generate a DKIM key, add it to your DNS and click Start authentication.

  3. 3.Wait 48 hours

    Google recommends waiting 48 hours after setting up SPF and DKIM before adding DMARC.

  4. 4.Add the DMARC record

    Create a TXT record with the host _dmarc and the value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk.

  5. 5.Read reports and tighten

    Review the reports for a few weeks, fix any service that fails, then move to p=quarantine and later p=reject.

Frequently asked questions

Can I set up DMARC inside the Google Admin console?

No. DMARC is a DNS record, so it goes in your domain's DNS settings, not in Google Workspace. Google provides the DKIM key, but the DMARC record is yours to write.

Where should DMARC reports go?

To a mailbox you create for the purpose, such as dmarc@yourdomain.co.uk, or to a DMARC reporting service that turns the XML files into readable charts. The reports can be numerous, so keep them out of your main inbox.

Do I need DMARC if I only send a few emails a day?

Google only requires it from senders of 5,000 or more emails a day to Gmail, but it's free and stops scammers sending fake emails from your domain, so we recommend it for every business.

Sources

  1. Google Workspace, Set up DMARC
  2. Google Workspace, Set up SPF
  3. Google Workspace, Set up DKIM
  4. RFC 7489, DMARC

Keep reading

A brass padlock with two keys beside it on a white backgroundTutorialHow to set up DMARC for Microsoft 365Add an SPF record with include:spf.protection.outlook.com, then create the two DKIM CNAME records Microsoft gives you and switch on DKIM signing in the Defender portal. Once both pass, add a TXT record at _dmarc with v=DMARC1; p=none; rua=mailto: and a reporting address, and tighten the policy later.Email and domains · 15 October 2026A tall stack of envelopes and letters seen side on, the scale bulk senders work atQuestionGoogle, Yahoo and Outlook bulk sender rules, explainedGmail, Yahoo and Outlook.com require anyone sending around 5,000 or more emails a day to them to pass SPF, DKIM and DMARC, offer one-click unsubscribe and keep spam complaints below 0.3%. Every sender, whatever the volume, needs at least SPF or DKIM, valid reverse DNS and a low spam rate.Email and domains · 15 October 2026Red octagonal stop sign against a blue sky, like a mail server refusing a messageQuestionWhat does a 550 email bounce error mean?A 550 error means the receiving mail server permanently refused your email, so it won't try again. The extra code after it gives the reason. 5.1.1 means the address doesn't exist, 5.7.1 means it was blocked as spam or by a policy, and 5.7.26 means your domain's SPF or DKIM authentication failed.Email and domains · 14 October 2026Two stacked cardboard boxes, ready for a move, like your email moving to a new providerTutorialHow to change MX records without losing emailLog in to wherever your domain's DNS is managed, delete the old MX records, and add the new ones your email provider gives you with the exact priority numbers. Lower the TTL a day before if you can. New email reaches the new provider within minutes to hours, so keep the old mailboxes open for a few days.Email and domains · 14 October 2026Wooden arrow-shaped signpost against a blue sky, pointing the wayTutorialHow to point a domain to a websiteYou have two options. Change your domain's nameservers to the ones your host gives you, which hands over all your DNS. Or keep your DNS where it is and add an A record for the root domain plus a CNAME for www. Either way, copy your email records first so your inbox keeps working.Email and domains · 14 October 2026

Want email on your own domain?

Hosteaze hosting plans let you set up mailboxes on your own domain. See what each plan includes.

See hosting plans