Setting Up SPF, DKIM, and DMARC for Google Workspace: A Simple Guide

Hey there! Want to make sure your business emails are secure, trustworthy, and always land in inboxes—not spam folders? You’re in the right place.

Setting up SPF, DKIM, and DMARC for your Google Workspace might sound a little technical, but don’t worry—we’ll break it down step by step. Think of these three as security guards for your emails, making sure only the genuine ones reach your customers.

Whether you’re running a small startup in Karachi or managing a large company in Lahore, this guide will help you protect your reputation and improve email delivery.

Why Email Authentication Matters

Imagine someone pretending to be you and sending fake emails to your clients. Scary, right? That’s exactly what can happen if you don’t secure your domain. Cybercriminals can spoof your business email and trick people into opening dangerous messages.

That’s where our three superheroes step in:

• SPF (Sender Policy Framework): A guest list of servers allowed to send emails for your domain.
  
  
• DKIM (DomainKeys Identified Mail): A digital signature proving your email really came from you.
  
  
• DMARC (Domain-based Message Authentication, Reporting & Conformance): The boss that checks SPF and DKIM, then decides what to do with suspicious emails.
  
  

Since February 2024, Google and Yahoo require all businesses sending more than 5,000 emails daily to have these protections in place. But even if you send fewer emails, setting them up is highly recommended.

Key Benefits for Your Business

• Fewer emails ending up in spam
  
  
• Greater trust with customers (often showing a verified sender badge)
  
  
• Stronger protection against phishing attacks
  
  
• Better email delivery rates overall
  
  

And in Pakistan, where many ISPs and corporate networks use strict spam filters, having SPF, DKIM, and DMARC can mean the difference between your proposal reaching the CEO—or disappearing into a junk folder.

Step 1: Setting Up SPF – Your Guest List

SPF is like the bouncer at your email door. Only the servers you approve can send messages on behalf of your business.

How to set it up:

1. Log in to your domain provider (GoDaddy, Namecheap, Cloudflare, etc.).
   
   
2. Find the DNS settings (look for “DNS” or “Domain Management”).
   
   
3. Check if you already have an SPF record (a TXT record starting with v=spf1).
   
   
   • If you already have one, add include:_spf.google.com before the ~all part.
     
     

If you don’t, create a new TXT record with this value:

v=spf1 include:_spf.google.com ~all

Important: You can only have one SPF record per domain. If you use other services (like Mailchimp), you’ll need to combine them, for example:

v=spf1 include:_spf.google.com include:mailchimp.com ~all

Step 2: Setting Up DKIM – Your Secret Signature

DKIM adds a hidden digital signature to each outgoing email, proving it hasn’t been tampered with.

How to set it up in Google Workspace:

1. Go to admin.google.com and log in to your Admin Console.
   
   
2. Click on Apps > Google Workspace Core Services > Gmail > Authenticate Email.
   
   
3. Select your domain and click Generate New Record.
   
   
4. Choose 2048-bit for stronger security.
   
   
5. Google will generate a DKIM record. Copy the hostname and value.
   
   
6. Go to your DNS settings with your domain provider.
   
   
7. Create a new TXT record with the details from Google.
   
   
8. Return to the Admin Console and click Start Authentication.
   
   

Note: DNS changes can take anywhere from 15 minutes to 24 hours to fully update.

Step 3: Setting Up DMARC – The Supervisor

DMARC brings SPF and DKIM together and decides how to handle suspicious emails.

⚠️ Make sure SPF and DKIM have been working for at least 48 hours before setting this up.

Start with a monitoring policy:

Name: _dmarc

Value: v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

• v=DMARC1 → Using DMARC version 1
  
  
• p=none → Monitor only (no blocking yet)
  
  
• rua= → Reports will be sent to your email address
  
  

Progression examples:

Monitor only:

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

Quarantine suspicious emails:

v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com

Reject all fake emails:

v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com

Testing Your Setup

Once everything is configured, test it:

• SPF: Send a test email and check the headers—it should say SPF=PASS.
  
  
• DKIM: Email headers should show “signed by yourdomain.com.”
  
  
• DMARC: Wait a few days to receive DMARC reports.
  
  

You can also use free tools like:

• MXToolbox SPF/DKIM/DMARC Checker
  
  
• Google Admin Toolbox CheckMX
  
  
• Mail-Tester.com
  
  

Troubleshooting Quick Tips

• SPF not working?
  
  
  • Ensure only one SPF record exists.
    
    
  • Double-check there are no typos.
    
    
• DKIM failing?
  
  
  • Wait for DNS to update (up to 24 hours).
    
    
  • Make sure you copied the TXT record exactly.
    
    
  • Confirm “Start Authentication” was clicked.
    
    
• No DMARC reports?
  
  
  • Verify the email address in your record.
    
    
  • Check your spam folder.
    
    
  • Be patient—reports are often weekly.
    
    

Why Choose CreativeON as Your Google Workspace Partner

When you work with CreativeON, you’re not just buying Google Workspace—you’re getting full local support.

• ✅ Expert setup & configuration (SPF, DKIM, DMARC done right)
  
  
• ✅ Local support in Pakistan (Urdu & English)
  
  
• ✅ Better pricing (from $3.80/month, lower than Google direct rates)
  
  
• ✅ Migration help for your existing emails
  
  
• ✅ 24/7 support for your business
  
  

Wrapping Up

To recap:

• SPF = Guest list of approved senders
  
  
• DKIM = Secret digital signature
  
  
• DMARC = Supervisor enforcing the rules
  
  

Setting these up makes your emails more secure, improves delivery rates, and protects your brand reputation. And if you don’t want to deal with the technical setup, CreativeON can handle everything for you at affordable rates.

Your business emails are too important to risk—secure them today.