How to Prevent Your Google Workspace Outgoing Emails From Going to Spam (Authenticate Emails With SPF and DKIM)

Quick and easy-to-follow guide for Google Workspace administrators

My Google Workspace emails are being marked spam - what do I do?

You can prevent emails sent from any user at your Google Workspace from getting marked as spam.
You need to add email authentication – this is what tells email recipients to trust you and keep you out of their spam folders.

Email authentication relies on DNS records

You add authentication by adding DNS records.
You do this at your DNS hosting provider, not in the Google Workspace settings.
The first record you’ll add is called DKIM (DomainKeys Identified Mail). DKIM adds a unique digital signature to your sent mail. This signature isn’t visible in the body of your email.
The DKIM record key is unique for every domain, so you need to generate the key by following the steps below.

How to set up DKIM in Google Workspace step-by-step with images

Step 1

In the Admin console at https://admin.google.com, click the Apps icon.

Step 2

Select Google Workspace.

Step 3

Click Gmail. Make sure not to check the box to the left; just click the service.

Step 4

Select Authenticate email.

Step 5

Click GENERATE NEW RECORD. If you have multiple domains, you need to generate a unique record for each of them. Click Selected domain to make sure you are generating the record for the right domain.

Step 6

Select DKIM key bit length: 1024.

A note here – 2048 is the better option as it’s considered safer. However, not all hosting providers will allow you to add 2048 characters to the TXT record.

Not adding all characters exactly as they are presented in the Admin console breaks the setting. If you go with 2048, make sure to verify that none of the text gets cut off after pasting it in your DNS settings.

Prefix selector: leave it as google.

Click GENERATE.

Step 7

Now you see the DNS Host name and TXT record value. Don’t close this page.

Copy the DNS Host name, which should be google._domainkey, and go to your hosting’s DNS settings to add a new TXT record.

Here is a list of links to the most frequently used hosting providers’ pages that show you how to add records and contact support. If you don’t see your hosting in the list, go to Google Search and look for “add txt record -your domain host’s name here-” (for example: add txt record Siteground.com)

Then follow your domain host’s guide on creating a TXT record. Contact the hosting’s support team if you can’t find instructions or they don’t help.

Step 8

This is an example of what a DNS management page looks when you’re adding a TXT record.

We’re adding a TXT record where the Host Name is google._domainkey. The host appends the superadminhelper.com domain by default, but this may not be the case in your hosting.

Ultimately, you need the record to be hosted at google._domainkey.yourdomain.com (or .org, etc.)

Step 9

Then back on the Google Workspace page, copy the code under TXT record value.

Step 10

Paste it into the TXT Value field in your hosting’s TXT setup page.

Step 11

Make sure to click SAVE after adding the record.

Step 12

After saving the record at your hosting, back on the Google Workspace page, click START AUTHENTICATION.

Step 13

When done correctly, the Status: will change to Authenticating email.

Please note that after adding the record, it may take up to 24 hours or more to start working before you can finish the process with this step.

Step 14

If you get an error, this may be because your account is still new. New accounts usually get an error during the first 3 days after sign-up.

Otherwise, you must double-check your record using public DNS-checking tools. You can go to https://toolbox.googleapps.com/apps/main/ and click Dig.

Step 15

Then under Name, type google._domainkey.yourdomain.com and click on TXT.

Step 16

If your record has been added successfully, you will see it displayed in the info below.

Even if you see the record, you still may get an error in Google Workspace. The reason is that it can take some time to propagate. Propagation can take up to 24-48 hours in the worst-case scenario, but it usually takes less than an hour.

However, if you don’t see the record on the Toolbox site, you should contact your hosting’s support team to look into it as there may be an issue on their side.

How to set up an SPF record for Google Workspace step-by-step with images

Step 1

Additionally, you need to add one more TXT record for email authentication – this one is called SPF (Sender Policy Framework).

It allows you to specify all legitimate email servers you allow to send email from your domain. This is crucial.

The TXT record must contain this exact text: v=spf1 include:_spf.google.com ~all

Unlike DKIM, this record is not unique. It’s the same for all Google Workspace accounts.

If you also plan on sending through other mail servers, you need to add them to the SPF record just before ‘include:_spf.google.com ~all,’ using the ip4:address format.

For example, if you also want to send from a mail server with the IP address 11.22.333.444, your SPF must contain this text: v=spf1 ip4:11.22.333.444 include:_spf.google.com ~all.

The record should point to your domain name. If you have another text field, like Name as we see in SiteGround, you can either leave it blank, put in the @ sign, or if neither works, type your domain there.

Paste v=spf1 include:_spf.google.com ~all into the TXT Value field.

Step 2

Same as before, to verify it, it’s best to go to https://toolbox.googleapps.com/apps/main/ and click Dig.

Step 3

This time under Name, just type your domain name and click TXT. You’ll see the record displayed below.

It may not show up right away. The reason is that it can take some time to propagate. Propagation can take up to 24-48 hours in the worst-case scenario, but it usually takes less than an hour.

However, if you don’t see the record on the Toolbox site, you should contact your hosting’s support team to look into it as there may be an issue on their side.

That's all! You reached the end of the article. Continue to:

If you find this useful, share and help others!

What Is Phishing and How to Prevent It With Google Workspace

If you work with emails, you need to know what phishing is and how to prevent it.

What is Spoofing and How to Prevent It With DMARC

Add an email authentication protocol to protect your domain from being spoofed.

Anti-Spoofing: Add Protection From Incoming Emails Spoofing Your Domain

Protect users from emails pretending to be from your domain that lack SPF and DKIM authentication.

Anti-Spoofing: Add Protection From Incoming Unauthenticated Emails

Protect users from any emails that lack SPF and DKIM authentication.

Anti-Spoofing: Add Protection From Name Spoofing

Protect users from any emails where the email sender’s name is a name in your Google Workspace directory, but the email is not authenticated by your company’s domains or domain aliases.

Anti-Spoofing: Add Protection From Similar Domains Spoofing

Protect users from any emails coming from domains that look visually similar to trusted domains.

Anti-Spoofing: Add Protection From Groups Spoofing

Protect users from unauthenticated emails pretending to be from your domain that are sent to Groups.

Better Gmail and email marketing

If you work with Gmail or do email marketing, you will appreciate what these services can do for you.

See recommendations

Protect your data and maximize security

Data protection and security tools are crucial, especially if you store any sensitive data in your accounts.

See recommendations

Process optimization and collaboration

You can use these services to make tedious processes a whole lot easier, improve teamwork, save time, and get better results.

See recommendations

Resources for website creators

Awesome tools and services for easy and effective site building, content creation, SEO, email marketing, and more.

See recommendations

Get the best out of Google Workspace

Add essential functionality such as backup and increased security, get new awesome features, and optimize your work with these additional services for Google Workspace.

See recommendations

How to Prevent Your Google Workspace Outgoing Emails From Going to Spam (Authenticate Emails With SPF and DKIM)

Quick and easy-to-follow guide for Google Workspace administrators

My Google Workspace emails are being marked spam - what do I do?

Email authentication relies on DNS records

How to set up DKIM in Google Workspace step-by-step with images

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7

Step 8

Step 9

Step 10

Step 11

Step 12

Step 13

Step 14

Step 15

Step 16

How to set up an SPF record for Google Workspace step-by-step with images

Step 1

Step 2

Step 3

That's all! You reached the end of the article. Continue to:

If you find this useful, share and help others!

What Is Phishing and How to Prevent It With Google Workspace

What is Spoofing and How to Prevent It With DMARC

Anti-Spoofing: Add Protection From Incoming Emails Spoofing Your Domain

Anti-Spoofing: Add Protection From Incoming Unauthenticated Emails

Anti-Spoofing: Add Protection From Name Spoofing

Anti-Spoofing: Add Protection From Similar Domains Spoofing

Anti-Spoofing: Add Protection From Groups Spoofing

Better Gmail and email marketing

Protect your data and maximize security

Process optimization and collaboration

Resources for website creators

Get the best out of Google Workspace

Submit Feedback

Report An Issue With Workspace123

Missing Content

Be the first to know