SPF record for Google Workspace

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Google Workspace only

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com ~all

Google Workspace and Microsoft 365 (for example during a migration)

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

Google Workspace and Zendesk

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:mail.zendesk.com ~all

How SPF applies to Google Workspace mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Google Workspace sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• Google says some DNS hosts require the SPF string to be enclosed in quotes. Follow your host's convention; the quotes aren't part of the record.
• If you bought the domain from a Google partner, or your domain already has SPF set up by default, Google says you may not need to add it yourself. Check the live record first.
• Google recommends ~all, which asks receivers to mark mail from unlisted servers as spam rather than reject it.
• Google requires SPF, DKIM and DMARC from bulk senders (close to 5,000 or more messages a day to personal Gmail accounts).

How to add it

1. Sign in to the company that hosts your domain's DNS, not the Google Admin console: Google says you don't need to do anything in the Admin console to set up SPF.
2. Open the page where you edit TXT records and look for an existing record on the root (host @) that starts with v=spf1. For a subdomain, use the subdomain name as the host.
3. If there is one, add include:_spf.google.com to it. If there isn't, create a TXT record with v=spf1 include:_spf.google.com ~all.
4. Repeat for every domain you send from in Google Workspace: Google says each domain needs its own SPF record.
5. Save, then check the live record with the SPF Checker below. Google says it can take up to 48 hours for SPF authentication to start working.

DKIM and DMARC alignment

Google recommends setting up DKIM and DMARC alongside SPF. Generate a DKIM key in the Admin console and publish it (see our DKIM setup guide). Mail you send through Google Workspace from your own domain is then DKIM-signed with that domain, which is what DMARC checks first.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Google Workspace's include costs 1 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Google Workspace's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding a new sending service without updating the record. Google warns that mail from senders missing from SPF could be marked as spam.