Learn · 3 minute read

How to set up an SPF record for Google Workspace

If you use Google Workspace for mail, your SPF record needs to include Google. If you also send from a website or another service, it needs to include them too, in the same single record.

The record

Add one TXT record at the root of your domain (the name is @, or blank, depending on your DNS host):

v=spf1 include:_spf.google.com ~all

That says Google's servers may send mail for your domain, and anything else should be treated with suspicion (~all, a soft fail).

Adding another service

A domain must have one SPF record. Two records make SPF fail. To allow another service, add its include: to the same record:

v=spf1 include:_spf.google.com include:spf.your-sender.example ~all

Each service tells you its exact include value. Check the total: SPF allows at most 10 DNS lookups, and every include: counts, along with whatever it includes in turn.

Do not stop at SPF

SPF alone is not enough. In the Google Admin console, turn on DKIM signing for your domain (under Gmail's email authentication settings), then publish a DMARC record. What DKIM is and what DMARC is. Changes can take from a few minutes to a day to appear.

Check it

Run your domain through the free domain checker to see it. It tells you if you have more than one SPF record, too many lookups, or a missing include.

Common questions

Can I have two SPF records?

No. Publish a single record that lists every service. Two records cause a permanent error and SPF fails.

Should I use ~all or -all?

Most domains start with ~all (soft fail) and move to -all (hard fail) only once they are sure every sender is listed. DMARC does more of the work than either.

Does my website contact form need to be in SPF?

Yes, if it sends mail as your domain from its own server or a mail service. Add that sender, or better, send it through a service that signs with DKIM.

Check your own domainSee your SPF, DKIM and DMARC in seconds, free.

Open the checker

Keep reading

SendSend is an email API that checks these records for you and tells you when a domain is verified. Get started free.