How to Set Up DMARC for Google Workspace

Why Google Workspace Needs DMARC

Google Workspace is a common target for brand spoofing. Without DMARC, anyone can send mail that looks like it came from your domain. DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM alignment — and gives you aggregate reports so you can see who is sending as you.

This guide walks through generating a monitor-mode DMARC record, confirming SPF for Google, publishing the TXT record at your DNS host, waiting for reporting, then verifying. Start with p=none so you can observe before you enforce.

Step 1Generating Your DMARC Record

Create a TXT record at _dmarc.yourdomain.com that starts in monitor mode. Replace yourdomain.com with your real domain, and use a reporting address you control (or SimpleDMARC’s hosted RUA once you create an account).

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-reports@yourdomain.com; fo=1; adkim=r; aspf=r; pct=100

That record means:

• `p=none` — monitor only; spoofed mail is still delivered, but you receive reports
• `rua` / `ruf` — where aggregate and forensic reports are sent
• `adkim=r` / `aspf=r` — relaxed alignment (recommended while you inventory senders)

Step 2Configure SPF for Google Workspace

Google Workspace must be authorized in your SPF TXT record at the domain root (or the zone that sends mail). A typical Workspace-only SPF looks like:

v=spf1 include:_spf.google.com ~all

If you already have an SPF record, merge Google into it — never publish two SPF TXT records on the same name. Example with an ESP include:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Step 3Publish DMARC in Google Admin / DNS

DMARC is published in DNS, not inside the Gmail UI. Use whichever DNS host holds the zone for your Workspace primary domain (Cloud DNS, Cloudflare, GoDaddy, etc.).

1. Open your DNS provider’s DNS records editor.
2. Add a TXT record.
3. Host / name: _dmarc (some UIs want _dmarc.yourdomain.com).
4. Value: the full v=DMARC1; ... string from above (no extra quotes unless your host requires them).
5. Save and wait for propagation (often minutes; up to your TTL).

Google Admin Console does not store the DMARC TXT itself — it only helps you turn on DKIM signing under Apps → Google Workspace → Gmail → Authenticate email. Finish DKIM before you expect strong DMARC pass rates.

Step 4Wait for Enforcement (Monitor First)

Leave policy at p=none long enough to collect aggregate reports (typically one to two weeks of normal sending). Review:

• Unknown sources failing authentication
• Legitimate tools that need SPF includes or DKIM
• Percentage of mail that already passes

Only then move to p=quarantine, and later p=reject, when you are confident. You can raise policy by updating the same _dmarc TXT record.

Step 5Verify Your Setup

Confirm the live record and authentication posture:

1. Look up _dmarc.yourdomain.com with the DMARC Checker.
2. Confirm SPF with the SPF Checker.
3. Send a test message from Workspace to an external inbox and inspect authentication results (or use an email header analyzer).

When DMARC, SPF, and DKIM line up, you are ready to tighten policy and — if you want brand logos in supporting inboxes — plan BIMI after enforcement.