# SPF record for Google Workspace

URL: https://iblockspam.com/spf/google-workspace
Last updated: 2026-10-09

Include: include:_spf.google.com
Where it goes: Your domain (@)
DNS lookups: 1 of 10

Google Workspace (formerly G Suite) uses the SPF record v=spf1 include:_spf.google.com ~all, published as a TXT record on your domain. The include costs 1 DNS lookup. If other services also send as your domain, add their includes to this one record. Google recommends ~all and also asks you to set up DKIM and DMARC.

## Example records

- Google Workspace only (TXT, host @): `v=spf1 include:_spf.google.com ~all`
- Google Workspace and Microsoft 365 (for example during a migration) (TXT, host @): `v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all`
- Google Workspace and Zendesk (TXT, host @): `v=spf1 include:_spf.google.com include:mail.zendesk.com ~all`

## Notes

- Google says some DNS hosts require the SPF string to be enclosed in quotes. Follow your host's convention; the quotes aren't part of the record.
- If you bought the domain from a Google partner, or your domain already has SPF set up by default, Google says you may not need to add it yourself. Check the live record first.
- Google recommends `~all`, which asks receivers to mark mail from unlisted servers as spam rather than reject it.
- Google requires SPF, DKIM and DMARC from bulk senders (close to 5,000 or more messages a day to personal Gmail accounts).

## How to add it

- Sign in to the company that hosts your domain's DNS, not the Google Admin console: Google says you don't need to do anything in the Admin console to set up SPF.
- Open the page where you edit TXT records and look for an existing record on the root (host `@`) that starts with `v=spf1`. For a subdomain, use the subdomain name as the host.
- If there is one, add `include:_spf.google.com` to it. If there isn't, create a TXT record with `v=spf1 include:_spf.google.com ~all`.
- Repeat for every domain you send from in Google Workspace: Google says each domain needs its own SPF record.
- Save, then check the live record with the SPF Checker below. Google says it can take up to 48 hours for SPF authentication to start working.

## DKIM and DMARC

Google recommends setting up DKIM and DMARC alongside SPF. Generate a DKIM key in the Admin console and publish it (see our [DKIM setup guide](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace)). Mail you send through Google Workspace from your own domain is then DKIM-signed with that domain, which is what DMARC checks first.

## Common mistakes

- Adding a new sending service without updating the record. Google warns that mail from senders missing from SPF could be marked as spam.

**Q: What is the SPF record for Google Workspace?**
`v=spf1 include:_spf.google.com ~all`, published as a TXT record on your domain. If you already have an SPF record, add `include:_spf.google.com` to it instead of publishing a second record.

**Q: Should I use ~all or -all with Google Workspace?**
Google recommends `~all`. Microsoft recommends `-all` for its own service. Once DMARC is enforced, receivers act on the DMARC result, so the difference matters less. Our [soft fail vs hard fail guide](https://iblockspam.com/blog/spf-softfail-vs-hardfail) explains when each makes sense.

**Q: Do secondary domains and domain aliases need their own SPF record?**
Yes. Google says each domain must have its own SPF record, so repeat the setup for every domain you send email from. A record on one domain never covers another domain or its subdomains.

Sources:
- Google Workspace Admin Help: Set up SPF: https://knowledge.workspace.google.com/admin/security/set-up-spf

---

Source: iBlockSpam, https://iblockspam.com/spf/google-workspace (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt