Guides › Google Workspace

Google Workspace emails going to spam? Here's the fix

Q: What SPF record does Google Workspace need?

One TXT record at your domain that includes _spf.google.com, for example v=spf1 include:_spf.google.com ~all. Other services that send as your domain, such as an invoicing tool or booking system, belong in the same record. Two separate SPF records break SPF entirely.

If emails you send from your business Gmail land in customers' spam folders, especially at Outlook, Hotmail and Yahoo, the most likely cause is that DKIM was never switched on for your domain.

The short answer

Google Workspace doesn't sign your email with your own domain until an admin turns DKIM on. Until then, mailbox providers can't fully tie a message from you@yourcompany.com to your business. Add a missing DMARC record, or an SPF record that's lost track of the other tools sending as you, and your mail starts looking like the spoofed messages filters are built to catch.

The fix is three DNS changes: turn on DKIM in the Google Admin console, have one correct SPF record, and add DMARC.

Check what's wrong first

Run your domain through the free check to see your SPF, DKIM and DMARC records in a few seconds. You can also send an email to a Gmail address you own, open it, and choose ⋮ → Show original. If DKIM doesn't show your own domain, or DMARC isn't PASS, keep reading.

How to fix it

1. Turn on DKIM

Sign in to the Google Admin console as a super administrator.
Go to Menu → Apps → Google Workspace → Gmail → Authenticate email, and select your domain.
Click Generate new record. Choose a 2048-bit key if your DNS host supports it, otherwise 1024-bit, and keep the default prefix google. Don't click Start authentication yet.
At your DNS host, add a TXT record named google._domainkey with the long value Google shows, copied in full.
Back in Authenticate email, click Start authentication. When it works, the status reads "Authenticating email with DKIM".

Google says DKIM can take up to 48 hours to start working after you publish the record. If you only just set up Gmail for the domain, you may have to wait 24–72 hours before the Admin console will give you a key at all.

The usual mistakes: a value cut short when pasting (some DNS hosts silently truncate long TXT values), quote marks pasted into the value, or a DNS host that adds your domain to the record name, giving google._domainkey.yourcompany.com.yourcompany.com.

2. Have one SPF record that lists everything

Your domain needs exactly one TXT record starting with v=spf1. For Google Workspace alone:

v=spf1 include:_spf.google.com ~all

Add every other service that sends email "from" your domain to the same record: your invoicing tool, booking system, website forms, newsletter. Two SPF records, or one that needs more than 10 DNS lookups, break SPF completely, and mail from all of them suffers.

3. Add a DMARC record

Add a TXT record named _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

Start with p=none, which reports without blocking anything. Once a couple of weeks of reports show your real senders all passing, move to p=quarantine so mail impersonating your business goes to spam.

4. Test again

Send a new email to Gmail and to an Outlook or Hotmail address. In Gmail's Show original, SPF, DKIM and DMARC should all say PASS, with DKIM showing your own domain.

Still landing in spam?

If everything passes, look at the other senders. A booking system or CRM sending as your domain without its own DKIM setup can hurt the whole domain's reputation. Very short messages with just a link, big attachments, and mass emails sent from your personal inbox to a long list are also common triggers; send newsletters through a newsletter service set up on your domain instead. After a stretch of problems, expect a few days of normal sending before providers trust the domain again.

Rather not touch your DNS?

We fix it for $199: we turn on DKIM, clean up SPF, add DMARC, find every other tool sending as you, test real emails to Gmail, Outlook and Yahoo, and send a short report. If there's nothing to fix, you don't pay.

Email us your domain

Questions

Why are my Google Workspace emails going to spam?

Usually because DKIM was never turned on for your domain. Google Workspace doesn't sign mail with your own domain until an admin generates a DKIM key and publishes it in DNS. Without it, and without a DMARC record, other mailbox providers such as Outlook and Yahoo have less reason to trust your mail.

Where do I turn on DKIM in Google Workspace?

In the Google Admin console, go to Apps, Google Workspace, Gmail, then Authenticate email. Generate a new record, publish it as a TXT record at your DNS host, then come back and click Start authentication. You need to be a super administrator to generate the key.

Should I pick a 2048-bit or 1024-bit DKIM key?

Pick 2048-bit if your DNS host accepts it, which most do. Some older DNS hosts can't store a TXT value that long; Google says to use 1024-bit in that case. A 2048-bit key that's been cut off when pasted is worse than a 1024-bit key that's whole, because a broken key fails DKIM on every message.

What SPF record does Google Workspace need?

One TXT record at your domain that includes _spf.google.com, for example v=spf1 include:_spf.google.com ~all. Other services that send as your domain, such as an invoicing tool or booking system, belong in the same record. Two separate SPF records break SPF entirely.