Guides › DMARC for Google Workspace

DMARC record for Google Workspace

Google Workspace doesn't create a DMARC record for you, and there's no DMARC setting in the Admin console. You add it at your DNS host. Here's the record and what it needs.

Rather not do this yourself? We find and fix what's sending your email to spam for $199. If there's nothing to fix, you don't pay.

Email us your domain Free check

The record

A DMARC record is one TXT record at your domain's DNS host. For Google Workspace, start with:

Name:  _dmarc
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

v=DMARC1 says it's a DMARC record. It must come first.
p=none is the policy: report only, block nothing. It's the safe place to start, and it meets Gmail's and Yahoo's requirement that bulk senders publish DMARC.
rua= is where mailbox providers send daily reports about mail using your domain. Use a mailbox you can read, or a DMARC report service.

Some DNS hosts want the name as _dmarc, others as _dmarc.yourcompany.com. If yours adds the domain automatically, entering the full name creates _dmarc.yourcompany.com.yourcompany.com, which doesn't work. Check with the free check after saving.

Where it goes

The record goes at your DNS host, which is wherever your domain's nameservers point: GoDaddy, Squarespace, Cloudflare, Namecheap, IONOS and so on. Not in the Google Admin console: Google only shows DKIM there.

Before you add it: SPF and DKIM

DMARC passes only when SPF or DKIM passes and matches your From domain. For Google Workspace that means:

SPF: one TXT record on your domain that includes include:_spf.google.com, plus every other service that sends as you.
DKIM: signing turned on for your own domain. It isn't by default. See our Google Workspace guide for turning it on in the Admin console.

DKIM matters most, because it survives forwarding and is the one that usually makes DMARC pass.

Tightening it later

After a couple of weeks, read the reports. Once every real sender passes, including your website, invoicing tool and newsletter service, move to p=quarantine, then p=reject. That's what stops other people sending email as your domain. Our DMARC policy guide walks through it.

Want it set up and checked?

We fix it for $199: SPF, DKIM and DMARC for your email provider and every tool that sends as you, real test emails to Gmail, Outlook and Yahoo, and a short report. If there's nothing to fix, you don't pay.

Email us your domain

Questions

What DMARC record should I use for Google Workspace?

Start with a TXT record named _dmarc with the value v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com. It reports without blocking. Once all your real senders pass, move the policy to quarantine and then reject.

Where do I add DMARC for Google Workspace?

At your domain's DNS host, such as GoDaddy, Squarespace or Cloudflare. The Google Admin console doesn't have a DMARC setting; it only handles DKIM.

Do I need DKIM before DMARC in Google Workspace?

You should turn it on first. DMARC passes when SPF or DKIM passes and matches your domain, and Google doesn't sign with your domain until you turn on DKIM in the Admin console. Without it, DMARC relies on SPF alone, which breaks when mail is forwarded.

What's the SPF record for Google Workspace?

One TXT record on your domain including _spf.google.com, for example v=spf1 include:_spf.google.com ~all, with any other services that send as your domain added to the same record.