DMARC setup for Google Workspace

Google Workspace can receive mail for a custom domain and sign outbound Gmail traffic after a DKIM key is generated and authentication is started.

Google Admin provides verification and mail-routing values, but records must be published at the authoritative DNS provider.

Google's standard Workspace authorization uses include:_spf.google.com. Use the exact current Google guidance and merge other authorized services into the same record.

A domain must publish one SPF record. If another service already sends mail, merge its authorization into the existing record and evaluate the complete DNS lookup count.

Generate a DKIM record for the custom domain in Google Admin, publish the selector and public key, then start authentication. Use a 2048-bit key where the DNS host supports the record size.

After activation, send a representative message and confirm DKIM passes with the custom domain as the signing identity.

DKIM is selector-specific. Confirm the selector shown by the provider resolves in public DNS and then send a message to a mailbox where you can inspect Authentication-Results.

DMARC checks whether SPF or DKIM passes and aligns with the domain visible in the From address. Start with reporting while legitimate services are still being identified.

Move to quarantine and reject only after reports show that real senders authenticate correctly. Use pct for a controlled rollout, and review the sp policy when subdomains send mail.

Google authorization covers Google sending infrastructure, not every SaaS platform. Configure custom DKIM or a custom return path for each external sender where available.

Provider authentication covers that provider, not every system using the same visible From domain.

Check DNS from outside the provider dashboard, send representative messages and inspect both SPF and DKIM alignment. Then monitor aggregate DMARC reports as real traffic arrives.

Orillon groups sender evidence into recognizable services, explains failures and guides policy forward without treating a DNS record as proof that mail is protected.