DMARC for Gmail and Google Workspace

Google sends authenticated mail for Workspace using SPF and DKIM. DMARC tells receiving providers how to treat messages that fail those checks and where to send aggregate feedback.

1. Turn on DKIM in the Google Admin console and publish the suggested DNS records for your domain.
2. Ensure your SPF record includes Google's sending sources (typically an include:_spf.google.com style directive) without exceeding the DNS lookup limit.
3. Publish a DMARC record at _dmarc starting with p=none and a valid rua mailbox to collect reports.
4. After one to two weeks of clean reports, plan a staged move to quarantine and then reject with a percentage rollout if needed.

Run our free scanner to see live SPF, DKIM, and DMARC status for any domain.