How to Set Up DMARC for Google Workspace

Q: What DMARC record should I use with Google Workspace?

Start with v=DMARC1; p=none; rua=mailto:your-email@yourdomain.com to monitor authentication results. After confirming all legitimate email passes, gradually move to p=quarantine and then p=reject.

Publish a DMARC policy for your domain to instruct receiving mail servers how to handle messages that fail SPF and DKIM authentication.

Quick Answer — The Record You Need

Record Type

TXT

Host / Name

_dmarc

Value

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Start with p=none to monitor, then move to p=quarantine and finally p=reject.

Step-by-Step Setup

Ensure SPF and DKIM are configured

DMARC builds on SPF and DKIM. Verify both are set up and passing for your Google Workspace domain before adding DMARC.

Choose your initial DMARC policy

Start with p=none (monitoring only) to collect reports without affecting mail delivery. This lets you identify all legitimate senders before enforcing.

Create the DMARC TXT record

Add a TXT record in your DNS with the host _dmarc and your chosen DMARC policy. Replace the email address with your own reporting address.

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Monitor DMARC reports

Aggregate reports (rua) will be sent in XML format. Use a DMARC report analyzer to read them and identify any legitimate senders that are failing authentication.

Gradually enforce your policy

Once all legitimate senders pass, move to p=quarantine (with pct=10 initially), then increase to pct=100, and finally to p=reject.

v=DMARC1; p=reject; rua=mailto:[email protected]; fo=1

Before & After

Before

(no DMARC record)

After

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Common Gotchas

Do not jump straight to p=reject. You may block legitimate email from third-party services you forgot to authorize in SPF/DKIM.
The _dmarc record must be at _dmarc.yourdomain.com, not _dmarc.mail.yourdomain.com or any subdomain, unless you want a subdomain-specific policy.
Google sends DMARC aggregate reports as large XML files. Use a dedicated DMARC reporting service to parse them rather than reading raw XML.

Verify Your Setup

After adding your DNS records, use our free DMARC checker to verify everything is configured correctly. DNS changes typically propagate within minutes, but can take up to 48 hours.

Frequently Asked Questions

What DMARC record should I use with Google Workspace?

Start with v=DMARC1; p=none; rua=mailto:[email protected] to monitor authentication results. After confirming all legitimate email passes, gradually move to p=quarantine and then p=reject.

Does Google Workspace support DMARC alignment?

Yes. Google Workspace emails align on both SPF (envelope sender matches header from) and DKIM (d= domain matches header from) when properly configured.

How long should I stay on p=none before enforcing?

Monitor with p=none for at least 2-4 weeks. Review aggregate reports to ensure all legitimate sending services are properly authenticated before moving to quarantine or reject.