How to set up DKIM and SPF for DNS records in Google Workspace

Raised from ticket #2059

If you are experiencing issues with your emails being marked as spam, setting up DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework) records can help improve your email deliverability. Follow these steps to configure these records:

Setting Up DKIM

  1. Access the Google Admin Console: Sign in to your Google Admin console using your administrator account.
  2. Navigate to: Apps > Google Workspace > Gmail.
  3. Authenticate Email: Click on Authenticate email.
  4. Generate a DKIM Key:
    • Select your domain from the dropdown.
    • Click on Generate new record.
    • Choose your DKIM key settings:
      • DKIM key bit length: Choose 2048-bit for better security.
      • Prefix selector: Use the default ‘google’ if this is your first setup.
    • Click Generate.
  5. Add the DKIM Key to Your DNS Records:
    • Log in to your domain host’s DNS management console.
    • Add a new TXT record with the following details:
      • Host/Name: Enter the TXT record name provided (e.g., google._domainkey).
      • Value: Paste the TXT record value generated in the Admin console.
    • Save the changes.
  6. Activate DKIM Signing:
    • Return to the Google Admin console.
    • Select your domain in the Authenticate email section.
    • Click on Start authentication.
    • The status should update to Authenticating email with DKIM.

Note: DNS changes can take up to 48 hours to propagate.

Setting Up SPF

To set up SPF, you will need to add a TXT record to your DNS settings:

  1. Log in to your domain host’s DNS management console.
  2. Add a new TXT record with the following details:
    • Host/Name: @ (or your domain name)
    • Value: v=spf1 include:_spf.google.com ~all
  3. Save the changes.

By following these steps, you can enhance your email security and reduce the likelihood of your emails being marked as spam.