Setup Guides · Google Workspace

Google Workspace DMARC Setup: The Enforcement Path Without Breaking Your Mail

Q: Do I configure DMARC in the Google Admin console?

No. DMARC is a single TXT record you publish in your public DNS at _dmarc.yourdomain.com, not a setting in the Admin console. Google Workspace provides the SPF and DKIM alignment that DMARC checks; the policy itself lives in DNS.

Q: Why does my Workspace mail fail DMARC when DKIM passes?

Until you turn on custom DKIM, Google signs as d=yourdomain.com.yourdomain.com.gappssmtp.com, which verifies but does not align with your From domain. DMARC then relies on SPF alone, which breaks whenever mail is forwarded. Set up the google._domainkey DKIM record first.

Q: Does Google require DMARC?

Yes. Since 2024 Google requires bulk senders (roughly 5,000+ messages a day to Gmail) to publish a DMARC policy of at least p=none alongside aligned SPF and DKIM. Every sender benefits from it, and monitored enforcement is how you satisfy the requirement safely.

Q: Will DMARC break my Google Groups or forwarding?

Forwarding and mailing lists break SPF, so mail that relies on SPF-only alignment can fail DMARC after being forwarded. Aligned DKIM survives forwarding, which is exactly why you enable custom DKIM before moving to p=reject.

The DMARC record is one TXT entry. On Google Workspace the real work is alignment: until you turn on custom DKIM, Google signs as gappssmtp.com, so your DMARC leans on SPF alone - and SPF breaks the moment a message is forwarded or hits a Group. This guide covers the exact record, the monitor-then-enforce path to p=reject, and the Workspace-specific traps. For the generic mechanics, see DMARC setup and enforcement.

Last updated 30 August 2026 · applies to all Google Workspace domains

Why alignment is the hard part on Google Workspace

DMARC does not ask whether SPF or DKIM passed - it asks whether the domain that passed matches your From domain (see what alignment means). Workspace gives you two alignment paths, and out of the box only one half-works:

SPF aligns once you publish include:_spf.google.com (see the Google Workspace SPF guide). It aligns on direct mail - but SPF breaks on forwarding and Google Groups, so it cannot carry an enforced policy alone.
DKIM aligns only after you turn on custom DKIM and publish the google._domainkey record. Until then Google signs with the gappssmtp.com default, which never aligns (the gappssmtp trap). Aligned DKIM survives forwarding - it is what makes p=reject safe.

Do these two first

Before you enforce DMARC, finish custom DKIM (google._domainkey) and a correct SPF record. DMARC is only as safe as the alignment underneath it.

What you need

Custom DKIM turned on in the Admin console and verifying as d=yourdomain.com.
An SPF record containing include:_spf.google.com.
Access to your public DNS to publish one _dmarc TXT record.
A free DMARC monitor to read the reports before you tighten the policy.

The setup, step by step

1 Confirm both alignment paths

Send one email and check the headers (or run it through Postbox Mailtester). SPF should show your domain via _spf.google.com, and the DKIM-Signature should read d=yourdomain.com - not the long ...gappssmtp.com default. If DKIM still shows gappssmtp, fix that first; enforcing now would rely on SPF alone.

2 Publish the DMARC record at p=none

In your public DNS, add one TXT record. This changes nothing about delivery - it only asks receivers to report what is sent as your domain.

Name:  _dmarc.yourdomain.com
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r

DMARC lives in DNS, not the Admin console - the console only manages SPF and DKIM. If a checker shows two _dmarc records, merge them into one.

3 Monitor - see who sends as your domain

Aggregate reports arrive as raw XML from dozens of receivers. Point the rua address at Postbox DMARC Monitor for a plain-English weekly digest of every source and whether it aligns. Workspace domains almost always find sources they forgot - a marketing platform, an invoicing tool, an app using SMTP relay, mail sent through Google Groups.

4 Align the strays (the Workspace-specific ones)

For each legitimate source, add it to SPF or give it aligned DKIM. Watch the Workspace patterns: Google Groups and forwarding rewrite the path and break SPF (only DKIM survives), and mail sent via SMTP relay or the "Send mail as" alias often needs its own alignment. Do not enforce until the reports show every real source passing DMARC.

5 Ramp to quarantine, then reject

Move to p=quarantine (ease in with pct=25, still honoured by most receivers though DMARCbis has removed it), watch a week, then p=reject. Add sp=reject for subdomains you never send from, plus np=reject to block spoofed non-existent ones. Only unaligned, likely-spoofed mail is affected. The full ramp mechanics, and the pct=-to-t= change, are in the shared enforcement guide.

The Google sender requirements

Since February 2024, Google requires bulk senders - roughly 5,000+ messages a day to Gmail - to authenticate with SPF and DKIM, publish a DMARC policy of at least p=none, keep From alignment, and honour one-click unsubscribe. A monitored path to enforcement satisfies the DMARC requirement and protects your domain at the same time. Even below the bulk threshold, an aligned, enforced domain is treated more favourably by Gmail's filters.

The failures we keep finding

1. Enforcing on SPF alignment only

With DKIM still on the gappssmtp.com default, DMARC passes on SPF - until a message is forwarded or sent to a Group, SPF breaks, and at p=reject that legitimate mail bounces. Turn on custom DKIM before you enforce.

2. Google Groups treated as a spoofer

Mail delivered through a Group is forwarded, so SPF breaks and, without aligned DKIM, it fails DMARC - your own list traffic looks unauthenticated in the reports. Aligned DKIM fixes it; some teams also tune the Group's sender/authentication settings.

3. Jumping to reject before monitoring

Almost every domain sends from more services than the admin remembers. Enforce before reading the reports and you spam-folder or bounce that legitimate mail. Monitor at p=none first - always.

4. Subdomains left open

An enforced apex policy still leaves subdomains spoofable unless you set sp=. Set sp=reject for subdomains you never send from, and add np=reject (DMARCbis) to shut down spoofed non-existent subdomains at no monitoring cost.

Verify it end to end

Check the record: the DMARC checker validates it; the DMARC generator builds a correct one.
Monitor before enforcing: Postbox DMARC Monitor shows every source and its alignment - the evidence you tighten on.
Confirm on a real message: send one email to Postbox Mailtester - it reports SPF, DKIM, DMARC and whether each aligns, plus your Gmail sender-requirement compliance.

Frequently asked questions

Do I configure DMARC in the Google Admin console?

No - it is a TXT record in your public DNS at _dmarc.yourdomain.com, not an Admin console setting. Workspace supplies the SPF and DKIM alignment; the policy lives in DNS.

Why does my Workspace mail fail DMARC when DKIM passes?

Until you turn on custom DKIM, Google signs with the long ...gappssmtp.com default, which verifies but does not align. DMARC then relies on SPF alone, which breaks on forwarding. Publish the google._domainkey record first.

Does Google require DMARC?

Yes - since 2024 bulk senders (about 5,000+/day to Gmail) must publish at least p=none with aligned SPF and DKIM. Every sender benefits, and monitored enforcement satisfies it safely.

Will DMARC break Google Groups or forwarding?

Forwarding and Groups break SPF, so SPF-only mail can fail DMARC after being forwarded. Aligned DKIM survives forwarding - which is why you enable custom DKIM before p=reject.

Ready to see who is sending as your domain?

Monitor free with Postbox DMARC Monitor Talk to a deliverability expert