Google Workspace email security setup

Google authenticates mail to you aggressively — since 2024 Gmail has required SPF, DKIM and DMARC from bulk senders — but protecting your own domain's name is still your job. Four DNS records do it: SPF, DKIM, DMARC, and MTA-STS, in that order.

1 · SPF: one TXT record

At your domain root (host @), publish exactly one SPF record:

• Every other service sending as your domain (newsletter platform, CRM, invoicing) needs its own include: before the all term.
• Keep total DNS lookups under 10 and publish exactly one SPF record.
• Once DMARC reports confirm every sender is listed, tighten ~all to -all.

2 · DKIM: generate a 2048-bit key

Workspace won't sign with your domain until you generate and activate a key — until then Gmail signs with a shared Google identity that doesn't align for DMARC.

1. Admin console → Apps → Google Workspace → Gmail → Authenticate email.
2. Select your domain and click Generate new record. Choose 2048-bit (only drop to 1024 if your DNS host can't store a long TXT value — most can, split across quoted strings).
3. Publish the TXT record at google._domainkey.yourdomain.com exactly as shown.
4. Back in the Admin console, click Start authentication. Give DNS up to 48 hours; sent mail then shows DKIM: PASS in the message headers.

3 · DMARC: monitor, then enforce

Publish a TXT record at _dmarc.yourdomain.com:

1. Stay at p=none for 2–4 weeks and read the aggregate reports — this is where the forgotten form tool or billing system that sends as your domain shows up.
2. Move to p=quarantine (optionally pct=10 first), then finish at p=reject.
3. Mind subdomain policy: if you don't send from subdomains, add sp=reject.

4 · MTA-STS and TLS-RPT

Google's MX hosts fully support TLS, and Google itself publishes MTA-STS on gmail.com. Mirror it for your domain — two TXT records and one tiny hosted file:

List the MX hostnames your domain actually uses (check your MX records — newer Workspace setups use smtp.google.com, older ones aspmx.l.google.com and friends). Don't park in testing mode; it enforces nothing.

The pitfalls we see most on Workspace domains

• DKIM generated but never activated. The TXT is in DNS but "Start authentication" was never clicked — signing stays off.
• The default 1024-bit key from years ago. Generate a fresh 2048-bit key and rotate; weak keys undermine the whole scheme.
• SPF include sprawl pushing past the 10-lookup limit as marketing tools accumulate.
• DMARC parked at p=none forever — monitoring is a phase, not a destination.

On Microsoft 365 instead? There's a guide for that too.