FindLeadEmails
Email intelligence
Try it for free
Mail host · SPF

SPF record for Google Workspace

How to add a SPF record when DNS or mail is at Google Workspace. Real steps, then a live lookup.

Google hosts the mailboxes. DNS still lives at your registrar or Cloudflare.

include:_spf.google.com

  1. Open the DNS panel for the domain (wherever the NS records point — often Cloudflare or GoDaddy, not the Admin console).
  2. Add a TXT record on the apex (@) with v=spf1 include:_spf.google.com ~all — or merge that include into an existing SPF record. Do not publish two SPF records.
  3. Wait for the TTL, then look the record up. Google Admin > Account > Domains can also confirm it.

Official docs: Google Workspace. Other records for this provider: SPF · DKIM · DMARC

Does this page apply to you?

Run this first. Google Workspace only matters if it is where your DNS or mail actually lives.

dig +short MX yourdomain.com

Expect: Hostnames ending in google.com, such as smtp.google.com or aspmx.l.google.com. If they point elsewhere, mail is not hosted at Google.

Specific to Google Workspace

  • Google is the mail host here, so your DNS lives at your registrar or Cloudflare, not in the Google Admin console. The record is added where your nameservers point.
  • include:_spf.google.com chains to several more of Google's own records, so it spends a noticeable part of your ten-lookup allowance before you add anything.
  • Any sequencer or CRM that sends as your domain needs its include merged into this same record. Every addition spends more of the allowance.

What you should end up with

Illustrative values. Use the exact host and value your provider shows you where it generates them.

Type  Name  Value
TXT  @  v=spf1 include:_spf.google.com ~all

What the receiving server does with this record

On every incoming message the receiver reads the domain in the envelope sender (the Return-Path), fetches its TXT records, picks the one that starts v=spf1, and checks whether the sending IP is covered. It is a check on which servers may send for a domain, not on the visible From address; DMARC is what ties the two together.

Mistakes that break it

  • Two SPF records. A domain may have exactly one. Publish a second and SPF returns a permanent error, which receivers treat as a failure. Merge instead.
  • Over ten lookups. Each include costs a lookup plus whatever is inside it. See the SPF lookup limit.
  • A sender missing. Your sequencer, CRM and billing tool all send as your domain and each needs its include in this one record.
  • Wrong domain. SPF is not inherited by subdomains. If you send from mail.yourdomain.com, that name needs its own record.

Check it from the command line

Replace yourdomain.com and look for exactly one line that starts with "v=spf1:

dig +short TXT yourdomain.com

Check it live

Check the SPF record

Look up the live DNS after you save. This tool does not spend credits.

v=spf1 include:_spf.google.com ~all

Publish as a single TXT record on the apex. Never create two SPF records.

Related