How to Set Up SPF for Google Workspace

Add the correct SPF record to authorize Google Workspace to send email on behalf of your domain. This prevents spoofing and improves deliverability.

Quick Answer — The Record You Need

Record Type

TXT

Host / Name

Value

v=spf1 include:_spf.google.com ~all

If you have other senders, add their include mechanisms before ~all.

Step-by-Step Setup

Sign in to your DNS provider

Navigate to DNS management

Find the DNS settings or DNS zone editor for your domain.

Check for an existing SPF record

Look for a TXT record that starts with v=spf1. You should only have one SPF record per domain. If one exists, you will modify it rather than creating a new one.

dig TXT yourdomain.com +short | grep spf

Create or update the SPF TXT record

Add a new TXT record (or edit the existing one) with the host set to @ and the value below. If you already have an SPF record with other includes, add include:_spf.google.com before the ~all or -all.

v=spf1 include:_spf.google.com ~all

Verify the record

Wait a few minutes for DNS propagation, then verify the record is published. You can use dig or a DNS lookup tool.

dig TXT yourdomain.com +short

Before & After

Before

v=spf1 ~all

After

v=spf1 include:_spf.google.com ~all

Common Gotchas

You must have only one SPF record per domain. Multiple SPF records cause authentication failures. Merge them into a single record.
Use ~all (softfail) during initial setup. Switch to -all (hardfail) once you confirm all legitimate senders are included.
Google Workspace uses _spf.google.com, not google.com or gmail.com. Using the wrong include will not authorize Google's mail servers.

Verify Your Setup

After adding your DNS records, use our free SPF checker to verify everything is configured correctly. DNS changes typically propagate within minutes, but can take up to 48 hours.

Frequently Asked Questions

What SPF record do I need for Google Workspace?

You need a TXT record at @ with the value v=spf1 include:_spf.google.com ~all. This authorizes Google's mail servers to send email on behalf of your domain.

Can I use -all instead of ~all for Google Workspace SPF?

Yes. Using -all (hardfail) is stricter and will cause non-authorized emails to be rejected outright. Start with ~all and move to -all once you have confirmed all senders are included.

I already have an SPF record for another service. How do I add Google Workspace?

Add include:_spf.google.com to your existing SPF record. For example: v=spf1 include:_spf.google.com include:otherprovider.com ~all. Do not create a second SPF record.