Google Workspace
Authenticate Google mail in the right order.
Use Google’s current Admin console values for your domain. The examples below contain no tenant, user, or private-key information.
Before starting
- Inventory every non-Google sender.
- Keep the Google verification TXT or CNAME.
- Copy the exact MX values displayed in Google Admin.
- Never publish a DKIM private key.
Walkthrough
- Publish Google MX. Use the current record set shown by Google Workspace setup. Preserve priority exactly.
- Merge SPF. Add
include:_spf.google.comto the one existing SPF record, alongside other real senders. - Generate DKIM. In Google Admin, create the domain’s DKIM record and copy its selector and public value into Help4 DNS.
- Start authentication. Wait for DNS visibility, then enable DKIM signing in Google Admin.
- Monitor DMARC. Begin with
p=none; verify aligned Google and non-Google traffic before enforcement.
Generic record shapes
Use provider-generated values. These show format only.
SPF
@ TXT "v=spf1 include:_spf.google.com ~all"DKIM
SELECTOR._domainkey TXT "v=DKIM1; k=rsa; p=PROVIDER_PUBLIC_KEY"DMARC monitor
_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r;"Verification
- Exactly one SPF record exists.
- Google selector resolves publicly.
- Google Admin reports DKIM authentication active.
- A received test message shows DKIM pass.
- Visible From domain aligns through DKIM or SPF.
- DMARC aggregate reports show expected sources.