DMARC record for Google Workspace

Does this page apply to you?

Run this first. Google Workspace only matters if it is where your DNS or mail actually lives.

dig +short MX yourdomain.com

Expect: Hostnames ending in google.com, such as smtp.google.com or aspmx.l.google.com. If they point elsewhere, mail is not hosted at Google.

Specific to Google Workspace

• Gmail's bulk-sender rules apply once you send around 5,000 messages a day or more to Gmail addresses, and require DMARC at p=none or stricter. Cold outreach is usually far below that per domain, but the record still helps.
• Google sends aggregate reports daily. Point rua at a dedicated mailbox, not your own inbox.
• Before moving past p=none, make sure your sequencer's mail is aligned too. Google's own mail will pass; a third-party sender may not.

What you should end up with

Illustrative values. Use the exact host and value your provider shows you where it generates them.

Type  Name  Value
TXT  _dmarc  v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

What the receiving server does with this record

When a message arrives, the receiver looks up _dmarc. plus the From domain. DMARC passes when SPF or DKIM passes and the domain that passed matches the From domain. If it fails, the p= policy decides what happens: none does nothing, quarantine sends it to spam, reject refuses it. Either way the receiver can email you an aggregate report.

Mistakes that break it

• Jumping to `reject`. Start at p=none, read the reports, fix every legitimate sender, then tighten. Enforcing before that loses real mail.
• Two DMARC records. Like SPF, a domain should have only one.
• Reports into your inbox. Aggregate reports arrive daily as zipped XML from every provider that saw your mail. Use a dedicated address or a report parser.
• A `rua` address on another domain. Reports to an external domain are only sent if that domain publishes a record authorizing it.

Gmail and Yahoo have required DMARC from bulk senders since 2024, at a minimum p=none. Build the record with the DMARC generator.

Check it from the command line

dig +short TXT _dmarc.yourdomain.com