DKIM & SPF Setup for Google GSuite

To set up or edit your SPF record, you will need to add: include:_spf.google.com

Edit existing SPF record

1. Log in to your DNS hosting provider
2. Look for a TXT containing v=spf1
3. In your existing SPF record, you will append include:_spf.google.com
4. For example, if your existing record looks like v=spf1; mx; ip4:1.2.3.4; you would add the above include as follows v=spf1; mx; ip4:1.2.3.4; include:_spf.google.com

Create a new SPF record

1. Follow the instructions from our How to Create a New SPF Record Guide.
2. In the Value field, enter: v=spf1 include:_spf.google.com ~all and Save the TXT record.

Records for Subdomains

If you are creating a record for a subdomain, you will want to make sure that you specify the sub part of the domain in the Host/Name/Alias field for most DNS providers.

1. Enter the sub part of the domain, for example if the subdomain is mail.mxtoolbox.com you would want to enter mail into that field.

SPF and DMARC Alignment

By default, Google will set you up for sending using one of their domains for the return-path address. This domain will NOT pass SPF Alignment. At this time, this provider does NOT provide any mechanism that will allow SPF Alignment to pass. You need to enable DKIM for this provider to ensure your email will pass DMARC Compliance.

To set up your DKIM record with Google GSuite or edit your current SPF record to include GSuite, follow the steps below:

1. Generate the public domain key for your domain
2. Add the key to your domain’s DNS records so recipients can retrieve it for reading the DKIM header
3. Activate email signing to begin adding the DKIM header to outgoing mail messages

Note: Skip the first two steps if you purchased your domain from one of Google’s domain host partners during G Suite signup. Google automatically generates the domain key and adds the necessary DNS record when you turn on authentication.

If you already have a DKIM domain key for your domain (e.g., if your legacy mail server signs outgoing mail), you still need to generate a separate key for G Suite to utilize. The G Suite domain key differs from any other key by a string known as a selector prefix. The selector prefix for the G Suite domain key is “google” by default, but you can enter a new selector prefix when you generate the key if preferred.