Do I need to keep the old SPF record from my previous email provider?

No — a domain can only have one SPF record. Merge the previous provider's include (if you still send from it) into the same record as Google's include:_spf.google.com rather than adding a second TXT record.

Why does Google Workspace need me to click "Start authentication" after adding the DKIM record?

Publishing the TXT record only makes the public key available in DNS. Google still needs to be told to actually start signing outgoing mail with the matching private key, which is a separate step in the Admin Console.

What DMARC policy should I use with Google Workspace?

Start with p=none to collect reports without affecting delivery, then move to quarantine and eventually reject once reports confirm your legitimate mail passes SPF or DKIM consistently — see our DMARC setup guide for the full progression.

SPF, DKIM and DMARC for Google Workspace: Step by Step

This is the applied, do-this-in-order version — if you want to understand what SPF, DKIM and DMARC actually do first, read those guides. This one is just the Google Workspace-specific records and console clicks.

SPF for Google Workspace

Add a single TXT record at your domain's root:

v=spf1 include:_spf.google.com ~all

If you also send mail from other services (a CRM, a help desk, a marketing tool), add their includes to this same record — a domain can only have one SPF record, so a second one doesn't add coverage, it just breaks validation.

DKIM for Google Workspace

In the Admin Console, go to Apps → Google Workspace → Gmail → Authenticate email
Generate a new record — choose a 2048-bit key if offered; it's the stronger option and Google supports it
Google gives you a TXT record: a host name (the selector, something like google._domainkey) and a long value
Add that exact TXT record to your DNS
Back in the Admin Console, click "Start authentication" — adding the DNS record alone does not turn DKIM signing on

DMARC for Google Workspace

DMARC isn't configured inside Google Workspace at all — it's a plain DNS TXT record at _dmarc.yourdomain.com. Start with p=none to monitor without affecting delivery, and see our DMARC guide for choosing rua reporting addresses and moving to a stricter policy.

_dmarc.yourdomain.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Verifying All Three

Once records are published and DKIM authentication is started, an email security check confirms SPF, DKIM and DMARC are all resolving and aligned correctly.

Mistakes That Break This Setup

A leftover SPF record from a previous email provider, creating two SPF TXT records instead of one merged record
Adding the DKIM TXT record but never clicking "Start authentication" in the Admin Console — Google won't sign outgoing mail until you do
Checking DKIM status immediately after adding the record, before DNS has propagated — Google's own check can fail for reasons that have nothing to do with the record being wrong

Verify Your Setup

Run an email security check →Next: The same setup for Microsoft 365 →

Try it on your domain

See the theory in practice — run a Email Security Check for your own domain.