How to Prevent Your Google Workspace Outgoing Emails From Going to Spam (Authenticate Emails With SPF and DKIM)

Quick and easy-to-follow guide for Google Workspace administrators

My Google Workspace emails are being marked spam - what do I do?

You can prevent emails sent from any user at your Google Workspace from getting marked as spam.
You need to add email authentication – this is what tells email recipients to trust you and keep you out of their spam folders.

Email authentication relies on DNS records

You add authentication by adding DNS records.
You do this at your DNS hosting provider, not in the Google Workspace settings.
The first record you’ll add is called DKIM (DomainKeys Identified Mail). DKIM adds a unique digital signature to your sent mail. This signature isn’t visible in the body of your email.
The DKIM record key is unique for every domain, so you need to generate the key by following the steps below.

How to set up DKIM in Google Workspace step-by-step with images

Step 1

In the Admin console at https://admin.google.com, click the Apps icon.

Step 2

Select Google Workspace.

Step 3

Click Gmail. Make sure not to check the box to the left; just click the service.

Step 4

Select Authenticate email.

Step 5

Click GENERATE NEW RECORD. If you have multiple domains, you need to generate a unique record for each of them. Click Selected domain to make sure you are generating the record for the right domain.

Step 6

Select DKIM key bit length: 1024.

A note here – 2048 is the better option as it’s considered safer. However, not all hosting providers will allow you to add 2048 characters to the TXT record.

Not adding all characters exactly as they are presented in the Admin console breaks the setting. If you go with 2048, make sure to verify that none of the text gets cut off after pasting it in your DNS settings.

Prefix selector: leave it as google.

Click GENERATE.

Step 7

Now you see the DNS Host name and TXT record value. Don’t close this page.

Copy the DNS Host name, which should be google._domainkey, and go to your hosting’s DNS settings to add a new TXT record.

Here is a list of links to the most frequently used hosting providers’ pages that show you how to add records and contact support. If you don’t see your hosting in the list, go to Google Search and look for “add txt record -your domain host’s name here-” (for example: add txt record Siteground.com)

Then follow your domain host’s guide on creating a TXT record. Contact the hosting’s support team if you can’t find instructions or they don’t help.

Step 8

This is an example of what a DNS management page looks when you’re adding a TXT record.

We’re adding a TXT record where the Host Name is google._domainkey. The host appends the superadminhelper.com domain by default, but this may not be the case in your hosting.

Ultimately, you need the record to be hosted at google._domainkey.yourdomain.com (or .org, etc.)

Step 9

Then back on the Google Workspace page, copy the code under TXT record value.

Step 10

Paste it into the TXT Value field in your hosting’s TXT setup page.

Step 11

Make sure to click SAVE after adding the record.

Step 12

After saving the record at your hosting, back on the Google Workspace page, click START AUTHENTICATION.

Step 13

When done correctly, the Status: will change to Authenticating email.

Please note that after adding the record, it may take up to 24 hours or more to start working before you can finish the process with this step.

Step 14

If you get an error, this may be because your account is still new. New accounts usually get an error during the first 3 days after sign-up.

Otherwise, you must double-check your record using public DNS-checking tools. You can go to https://toolbox.googleapps.com/apps/main/ and click Dig.

Step 15

Then under Name, type google._domainkey.yourdomain.com and click on TXT.

Step 16

If your record has been added successfully, you will see it displayed in the info below.

Even if you see the record, you still may get an error in Google Workspace. The reason is that it can take some time to propagate. Propagation can take up to 24-48 hours in the worst-case scenario, but it usually takes less than an hour.

However, if you don’t see the record on the Toolbox site, you should contact your hosting’s support team to look into it as there may be an issue on their side.

How to set up an SPF record for Google Workspace step-by-step with images

Step 1

Additionally, you need to add one more TXT record for email authentication – this one is called SPF (Sender Policy Framework).

It allows you to specify all legitimate email servers you allow to send email from your domain. This is crucial.

The TXT record must contain this exact text: v=spf1 include:_spf.google.com ~all

Unlike DKIM, this record is not unique. It’s the same for all Google Workspace accounts.

If you also plan on sending through other mail servers, you need to add them to the SPF record just before ‘include:_spf.google.com ~all,’ using the ip4:address format.

For example, if you also want to send from a mail server with the IP address 11.22.333.444, your SPF must contain this text: v=spf1 ip4:11.22.333.444 include:_spf.google.com ~all.

The record should point to your domain name. If you have another text field, like Name as we see in SiteGround, you can either leave it blank, put in the @ sign, or if neither works, type your domain there.

Paste v=spf1 include:_spf.google.com ~all into the TXT Value field.

Step 2

Same as before, to verify it, it’s best to go to https://toolbox.googleapps.com/apps/main/ and click Dig.

Step 3

This time under Name, just type your domain name and click TXT. You’ll see the record displayed below.

It may not show up right away. The reason is that it can take some time to propagate. Propagation can take up to 24-48 hours in the worst-case scenario, but it usually takes less than an hour.

However, if you don’t see the record on the Toolbox site, you should contact your hosting’s support team to look into it as there may be an issue on their side.