How to Set Up DMARC for Google Workspace (Step-by-Step)

Setting up DMARC for Google Workspace is essential for protecting your domain and ensuring your emails reach the inbox. This guide walks you through the entire process.

Prerequisites

Before setting up DMARC, you need:

1. Admin access to Google Workspace
2. Access to your domain's DNS settings
3. SPF and DKIM already configured (we'll verify this first)

Step 1: Verify SPF is Set Up

First, let's make sure you have SPF configured:

1. Go to your DNS provider
2. Look for a TXT record on your root domain that contains v=spf1
3. It should include include:_spf.google.com

Your SPF record should look something like this:

v=spf1 include:_spf.google.com ~all

Step 2: Enable DKIM in Google Workspace

1. Sign in to your Google Admin console
2. Go to Apps > Google Workspace > Gmail > Authenticate email
3. Select your domain
4. Click Generate new record
5. Copy the TXT record value

Add this record to your DNS:

Record type: TXT
Host: google._domainkey
Value: [the value from Google Admin]

Wait 24-48 hours for DNS propagation, then click Start authentication in Google Admin.

Step 3: Create Your DMARC Record

Now you're ready to add DMARC. Start with a monitoring policy:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=r; aspf=r

Add this to your DNS:

Record type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Step 4: Monitor Your Reports

After adding the DMARC record, you'll start receiving XML reports. These can be difficult to read, which is why many organizations use a DMARC monitoring service.

Next Steps

After monitoring for 2-4 weeks:

1. Review your DMARC reports
2. Fix any legitimate sources failing authentication
3. Move to p=quarantine
4. Monitor for another 2-4 weeks
5. Finally move to p=reject

Troubleshooting

Common Issues

My emails are failing DMARC

• Check SPF alignment
• Verify DKIM is signing correctly
• Ensure forwarding isn't breaking authentication

I'm not receiving reports

• Verify the email address in your rua tag
• Check spam folder
• Wait 24-48 hours for first reports

Conclusion

Setting up DMARC for Google Workspace protects your domain from spoofing and improves email deliverability. Start with monitoring mode and gradually increase protection as you gain confidence.