To set up DMARC for Google Workspace: publish SPF v=spf1 include:_spf.google.com ~all, turn on DKIM in the Admin console (selector google) and publish the key it generates, then add a DMARC TXT record at _dmarc starting at p=none and tighten to p=reject once reports are clean.
Publish a single SPF record that authorizes Google: v=spf1 include:_spf.google.com ~all. If you also send through other services, add their includes to the same record and watch the 10-lookup limit.
In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email, generate the DKIM key (2048-bit), and publish the TXT record it gives you at selector google._domainkey. Then click Start authentication.
Add a TXT record at _dmarc: v=DMARC1; p=none; rua=mailto:[email protected]. Monitor the reports, confirm Google mail passes and aligns, then move to p=quarantine and p=reject.
Confirm the selector resolves after you publish it:
$ dig TXT google._domainkey.yourdomain.com +shortCheck your DMARC record now
Open the free DMARC checker →By default it is google, so the record lives at google._domainkey.yourdomain.com.
No. DKIM must be generated and enabled manually in the Admin console, and the TXT record published in your DNS.
