Google Workspace DNS Setup
Publish the SPF, DKIM and DMARC records a Google Workspace domain needs, then let DDMARC verify them and monitor the result.
What this page is
This is a DNS setup guide, not a directory integration. DDMARC does not use the Google Admin SDK against your organization, does not read your users or groups, does not inspect Gmail routing, and does not rotate your Workspace DKIM keys. Signing in to DDMARC with a Google account is single sign-on only — it asks for your name and email address, nothing more. You make the changes below in the Google Admin console and your DNS host; DDMARC reads the public result.
What DDMARC Does For You
Recognises Google as a sender
Google sending IPs in your DMARC reports are labelled as Google Workspace, so your own mail is distinguishable from everything else on the domain.
Probes the right DKIM selector
DDMARC knows Google Workspace signs with the google selector and looks that up directly, including signing domains like gappssmtp.com.
Validates what is published
Each DNS check reads your live SPF, DKIM and DMARC records and reports errors and warnings against them.
Watches for drift
On paid plans, scheduled monitoring re-checks these records and raises an alert if one changes or disappears.
Before you start
- • The domain is verified in the Google Admin console
- • You can edit DNS for the domain, at whichever host holds the zone
- • For the DKIM step, a Super Admin account (needed by Google, not by DDMARC). Delegated admins usually cannot generate a key.
- • The domain is added in DDMARC, so you have its reporting address
1. Publish SPF
Google Workspace sends from a shared pool authorised through a single include. Add it to the domain's existing SPF record — a domain may only publish one SPF record, so never create a second.
Any other service that sends as this domain needs its include in the same record, before the all mechanism. SPF permits at most 10 DNS lookups, and _spf.google.com alone costs several; DDMARC will warn you as you approach the limit.
2. Enable DKIM
Google Workspace publishes DKIM as a TXTrecord you generate in the Admin console and paste into DNS. Note that DKIM signing is off by default on a new Workspace domain — mail will still be signed by a gappssmtp.com subdomain, which does not align with your domain for DMARC.
Generate the key
- 1Go to the Google Admin console at admin.google.com
- 2Navigate to Apps → Google Workspace → Gmail
- 3Click Authenticate email
- 4Select your domain and click Generate new record
- 5Choose 2048-bit key length
- 6Copy the TXT record value
After the record resolves, go back to the Admin console and click Start authentication. Until you do, the key exists but nothing is signed with it. A 2048-bit key is longer than some DNS interfaces accept in one string — if yours rejects it, split the value into quoted chunks, which DNS concatenates.
3. Publish DMARC
Point the reporting address at the mailbox token DDMARC issued for this domain. Each domain has its own token; there is no shared address, and a generic one will not route.
Start at p=none so nothing is rejected while you find every legitimate sender, then move to quarantine and rejectonce your reports are clean. DDMARC's policy rollouts walk that progression for you.
4. Verify in DDMARC
Once the records are live, run a DNS check on the domain. DDMARC resolves SPF, DKIM and DMARC, validates each one and returns an overall status.
GET /api/v1/domains/{domain_id}/dns-checkcurl -X GET "https://api.ddmarc.com/api/v1/domains/42/dns-check?refresh=true" \
-H "X-API-Key: $DDMARC_API_KEY"Or just open the domain in the dashboard and use the DNS check there. Records can take up to 48 hours to propagate, though most hosts are far quicker.
Troubleshooting
DKIM authentication is stuck on pending
Google will not start signing until the TXT record resolves. Confirm the host is exactly google._domainkey and that your DNS host has not appended the domain twice.
DDMARC shows mail signed by gappssmtp.com
That is Google's default signing domain and it does not align with yours for DMARC. Generate the key and click Start authentication so messages are signed as your domain instead.
The DKIM value was truncated
Some DNS interfaces cap a TXT string at 255 characters. Split the value into multiple quoted strings on the same record; DNS joins them back together.
SPF fails for mail that clearly came from Google
Usually a second SPF record on the domain, or a forwarder rewriting the envelope sender. Check the DNS check output for a duplicate-record warning, and look at whether DKIM still aligns for those messages.
No reports are arriving
Confirm the rua address in your DMARC record uses this domain's own token. A DMARC record copied from another domain sends its reports somewhere else.
Done when
- SPF includes _spf.google.com and stays under 10 lookups
- A TXT record exists at google._domainkey and authentication is started in the Admin console
- A DMARC record exists at _dmarc with this domain's own rua token
- The DDMARC DNS check comes back pass
- Aggregate reports are arriving in DDMARC