Email & DNS guide
DMARC for Google Workspace domains
Connect Workspace signing, SPF alignment and a deliberate DMARC rollout for your custom domain.
Start with your sending inventory
Separate mail sent by Workspace from mail sent by marketing, billing or support tools. Record the From domain and provider for each stream. A Workspace configuration does not automatically authenticate a third-party platform that happens to use your email address.
Check provider authentication
Use Google's current administrator instructions to configure SPF and generate the DKIM settings for your domain. Publish the provided DNS value at the indicated selector and enable signing as instructed. Keep existing legitimate SPF sources in the same policy.
Add DMARC deliberately
Choose a report destination you can actually review. Observe authentication and alignment, repair legitimate failures, then evaluate quarantine or reject. Google's sender requirements vary with sending behavior and volume; consult the current guidelines when planning bulk mail.
Test every stream
Send a fresh message from Workspace and each connected sending platform. Read the receiver's Authentication-Results, rather than assuming successful delivery proves DMARC passed. Revisit the inventory when adding a new platform or changing your visible sender domain.
Primary references
Provider dashboards and instructions can change. Confirm current values with your provider before editing DNS.