SPF, DKIM and DMARC checker for Google Workspace

What this checker looks at

It asks public DNS three questions about your domain, the same ones a receiving mail server asks. It never connects to your mail server, never sends an email, and needs no access to anything of yours.

Answers are kept for 6 hours, so looking again is quick. After you change a record, press Check again and it asks DNS afresh.

SPF: who may send for your domain

SPF is a list of the servers allowed to send email for your domain. If you send only through Google, Google’s help gives this record to copy:

v=spf1 include:_spf.google.com ~all

If other services send for you too, such as a newsletter tool or your website’s contact form, they go in the same record. A domain should have one SPF record; with two, SPF fails for everybody. Google says it can take up to 48 hours to start working.

DKIM: proof the email wasn’t changed

DKIM adds a signature to each email, and the public key to check it sits in your DNS. For Google Workspace, an administrator generates the key in the Admin console under Apps, Google Workspace, Gmail, Authenticate email, adds the TXT record Google shows, then presses Start authentication.

If your result says Not confirmed, that isn’t a failure. The checker looks for Google’s usual selector, google. If someone chose a different selector, the key can’t be found from outside, and DKIM may be working fine. Sending yourself a test email and reading its original headers will settle it.

DMARC: what to do when the checks fail

DMARC tells receiving servers what to do with email that claims to be from your domain but fails SPF and DKIM. Google recommends starting with a policy of none, which changes nothing and only reports, once SPF and DKIM have been working for at least 48 hours:

v=DMARC1; p=none;

When you are sure your real mail passes, raise it to p=quarantine and later p=reject. That is why p=none shows here as Could be better: it meets Gmail’s rule for bulk senders, but doesn’t yet protect your domain from forgery.

What Gmail expects from senders

Google’s sender guidelines (read on 4 November 2026) set two levels:

• Everyone sending to personal Gmail accounts: SPF or DKIM, and a spam rate reported in Postmaster Tools below 0.3%.
• More than 5,000 messages a day: SPF and DKIM and DMARC (the policy may be none), the From address aligned with one of them, and one-click unsubscribe for marketing email.

Most people using a tool like this send far fewer than 5,000 a day. Setting up all three is still worth it: they take minutes, they cost nothing, and they are the first thing a receiving server looks at.

How to read your result

• Set up: nothing to do.
• Could be better: it works, and there is a safer setting. Usually DMARC at p=none.
• Needs fixing: missing or wrong. The fix and the record to add are shown beside it.
• Not confirmed: the checker can’t tell from outside. Usually DKIM with a custom selector, or DNS that did not answer in time.
• Handled by Google: for @gmail.com and @googlemail.com, Google looks after all three. There is nothing for you to set up.

How to add a record

1. Sign in where you manage your domain’s DNS, which is usually where you bought the domain.
2. Add a new TXT record with the name and value shown in your result. @ means the domain itself; some providers want it left blank.
3. Save it, wait, and press Check again here. It often shows within the hour, and can take up to 48 hours.

Sending through something other than Google?

This checker judges your records for mail sent through Google, because that is how Gmail and Google Workspace send. If you send only through another provider, an SPF record that doesn’t mention Google is right for you, so follow that provider’s instructions and read this result with that in mind.