Skip to main content
All CollectionsAccount Settings
Adding a SPF Record to GMail/GSuite
Adding a SPF Record to GMail/GSuite

An SPF record is the most important thing you can add to your email account for deliverability on your Google Apps and GSuite account.

Ryan O'Donnell avatar
Written by Ryan O'Donnell
Updated over a week ago

Want a really detailed guide to maximize email deliverability?  We wrote this post.

Need a new GSuite account to send cold emails?  Click here

Here's how to set up SPF and DKIM records for Google Apps

A Sender Policy Framework (SPF) record indicates which mail servers are authorized to send mail for a domain. Your email recipient’s mail servers perform a check: “Is this email coming from an authorized mail server?” If not, then the email in question is more likely to be spam. Your SPF DNS record lets the recipient server perform this verification. The SPF check verifies that an email comes from authorized servers.

If you use Google Apps for email, you'll need access to your DNS provider to add an SPF record. In most cases, you simply login and create a new TXT record with the value of:
v=spf1 include:_spf.google.com ~all
Google provides detailed instructions, as well. *Be sure to save your changes.*

You'll need access to your Google Apps control panel and your DNS records to set DKIM. This is a three step process:

Create the DKIM key 

  • Login to your Google Apps Control Panel

  • Go to the "Advanced tools" tab, then scroll down to "Authenticate email" and click on "Set up email authentication (DKIM)".  This will open a new screen.

  • Your domain name should be displayed. Click on "Generate new record". Leave the default selector prefix as "google". Click "Generate".

  • Leave this browser window open, and then create a new tab or browser window.

Create the DKIM DNS record

  • Login to your DNS provider. Get to a place where you can add a TXT record.

  • Create a new TXT record. The name of the TXT record should be:
    google._domainkey  This creates a domain that, fully resolved, looks like: google._domainkey.yourdomain.com.

  • The value for the DNS record will be a very long string of characters, something like:
    v=DKIM1; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCG5in7gQIDAQAB
    The actual length of the string will be much longer than that above. Copy-and-paste the information from the Control Panel page displaying the information. Save the DNS record.

Start Authenticating

  • Wait 24-hours for your changes to propagate, and for Google's servers to detect the changes.

  • Login to your Google Apps Control Panel (e.g.,http://www.google.com/a/cpanel/yourdomain.com)

  • Go to the "Advanced tools" tab, then scroll down to "Authenticate email" and click on "Set up email authentication (DKIM)". This will open a new screen.

  • Click "Start authentication".

  • Next, Add your sending domain name to your Google Postmasters account add one more layer of domain verification to Google App Mailbox and Gmail Mailboxes.  This helps you to get good email delivery inside Google App Mailbox and Gmail Mailboxes.

Once you get this set up, you’ll have access to several very valuable performance dashboards:

  • Spam Rate Dashboard: shows the volume of reported spam emails vs. emails sent to the Inbox only if you have DKIM and SPF records set up correctly.

  • Domain and IP Reputation Dashboard: you can see if the Gmail spam filter is likely (or not) to mark emails from your domain or IP as spam.

  • Feedback Loop Dashboard: shows the identifiers and spam rates that were flagged by FBL. You must have a feedback loop established here to get this data.

  • Authentication Dashboard: this dashboard shows traffic that passed authentication
    (SPF, DKIM, and DMARC) compared to the received traffic that attempted authentication.

  • Encryption Dashboard: shows TLS encrypted traffic compared to all mail received from that domain.

  • Delivery Errors Dashboard: shows all rejected or ‘temporarily failed’ traffic vs all authenticated traffic originating from that domain.
    Add the sending domain name to your Google Postmasters account and verify them here: https://postmaster.google.com/u/0/

Did this answer your question?