SPF record for Google Workspace

• Type: TXT
• Host: @, which means the root of your domain
• Records per domain: one. If you already have an SPF record, merge into it (below).

What the record says

• v=spf1 marks the record as SPF, version 1.
• include:_spf.google.com adds Google’s own list of sending servers, so mail sent through Google Workspace is allowed.
• ~all covers everything else. It tells receiving servers to treat mail from a server that is not on the list with suspicion (a soft fail), and Google recommends it. -all asks for outright rejection; use it only once every sender is listed.

Where to add it

You add it where your domain’s DNS is managed. That is often your registrar, such as Namecheap or GoDaddy, or a service like Cloudflare.

1. Sign in there and open the DNS records for your domain.
2. Add a new record of type TXT.
3. Set the host to @ and paste the record as the value. If you send from a subdomain, use the subdomain’s name as the host: each subdomain needs its own SPF record.
4. Save it.

It often shows up much sooner, but allow up to 48 hours, as Google’s own help says, before you decide it is not working.

If you already have an SPF record

Do not add a second one. Two SPF records make SPF fail for both. Merge them into one record: a single v=spf1 at the start, every include: from both records in the middle, and a single ~all at the end.

Check it

Type your domain into the SPF checker to see the record, that there is only one and that it ends safely. If you would rather build the record than edit it by hand, the SPF record generator has Google Workspace and other providers as options. The domain check looks at SPF, DKIM, DMARC and MX in one run.

Look it up from a terminal

You can read any domain’s SPF record without a website. On Windows, macOS or Linux, run nslookup -type=TXT yourdomain.com; on macOS and Linux, dig TXT yourdomain.com +short prints the same. Look for the line that starts with v=spf1. If two lines start that way, you have the two-record problem.

What the result means

Send a note to a Gmail address of your own, open it, and choose Show original. Gmail shows an SPF result at the top:

A worked example

This is an illustration. A team sends from Google Workspace and has just added a newsletter tool that sends as their domain. Their record is still v=spf1 include:_spf.google.com ~all, so the newsletter’s mail shows spf=softfail. The tool’s help page gives them an include, say include:sender.example.com. They edit the one record they have, never adding a second: v=spf1 include:_spf.google.com include:sender.example.com ~all. After DNS updates they send another test, and it shows spf=pass. Each new sender adds an include and, behind it, more DNS lookups, which is why the limit of 10 matters: Google’s include already uses several of them.

When SPF alone will not help

• Forwarded mail. When someone forwards your email, the forwarding server is not in your record, so SPF can fail even though you did everything right. DKIM usually survives forwarding, which is why you need both.
• The visible From address. SPF checks the hidden sending address (the envelope sender), not the From name people see. DMARC is what ties the two together.
• A bad list or a spammy message. A perfect record does not make mail with those problems reach the inbox. See why emails go to spam for the other eight causes.

Common mistakes

• Two SPF records. Merge them into one.
• More than 10 DNS lookups. Each include: counts, and so do the lookups inside it. Over the limit, SPF fails.
• Ending in +all. That allows anyone to send as your domain.
• Forgetting a sender. A CRM, a newsletter tool or a sending service that sends as your domain needs its own include: in the same record.
• Expecting SPF alone to fix spam. It is one of three records; DKIM and DMARC matter as much.

Next steps

SPF is the first of three records. Check DKIM with the DKIM checker and DMARC with the DMARC checker, and see the docs page DNS records for how each one works.