If your business email runs on Google Workspace, you need an SPF record that tells the rest of the internet Google is allowed to send email for your domain. Without it, the messages you send are easier to mark as spam, and it's easier for someone else to send email pretending to be you.
The good news is that the record itself is one line. The part that trips people up is everything around it.
The record
For a domain that sends email only through Google Workspace, add this as a TXT record on your root domain:
v=spf1 include:_spf.google.com ~all
Reading it left to right:
v=spf1marks it as an SPF record.include:_spf.google.comauthorises Google's mail servers, using a list Google maintains, so you never have to update it yourself when their servers change.~alltells receivers to treat anything not on the list with suspicion (a "soft fail"). This is what Google recommends, and it's the safe choice while you're getting set up.
Some older guides give a different Google address in the include. Use _spf.google.com, which is the one in Google's own Workspace help.
Where to add it
SPF lives in your domain's DNS, which is managed wherever your domain's nameservers point. That's usually your domain registrar (such as 123 Reg, GoDaddy or Namecheap), your web host, or a service like Cloudflare. It isn't in the Google Admin console.
At your DNS host, create a new record with:
| Field | Value |
|---|---|
| Type | TXT |
| Host / Name | @ (some hosts want it blank, or your bare domain name) |
| Value / Content | v=spf1 include:_spf.google.com ~all |
| TTL | Leave the default |
Changes usually show up within an hour, but DNS can take up to 48 hours to update everywhere, so don't panic if a check straight afterwards still shows the old result.
Before you add it: check for an existing record
This is the step that matters most. A domain can only have one SPF record. If you already have one, perhaps added by your web host or a previous email provider, and you add a second, receivers treat SPF as broken and it fails for every message.
Look through your existing TXT records for anything starting v=spf1. If there is one, edit it rather than adding a new record. If it still mentions an email provider you've moved away from, remove that part.
Our SPF checker tells you straight away whether your domain has zero, one or several SPF records.
When other tools send email for you
Google Workspace is rarely the only thing sending email from your domain. Your website's contact form, a newsletter tool, an online booking system, your accounting or invoicing software and your CRM may all send messages that appear to come from you.
Each one that sends using your domain needs adding to the same SPF record. Their setup guide will tell you what to add, usually an include: value. The merged record looks like this:
v=spf1 include:_spf.google.com include:servers.your-other-tool.example ~all
Everything goes between v=spf1 and ~all, in one record. Not every tool needs an SPF entry (some send from their own domain on your behalf, and some rely on DKIM instead), so follow each tool's own instructions rather than adding includes speculatively.
Website contact forms are worth a special mention. Many WordPress sites send form notifications straight from the web server, which isn't in your SPF record, so they fail. The cleaner fix is usually to send them through your Google Workspace account with an SMTP plugin, rather than adding your web host to SPF.
Watch the 10-lookup limit
SPF has a hard limit of 10 DNS lookups when a receiver checks your record. Every include: uses at least one, and some (Google's included) contain further includes that each count as well. Add four or five services and you can go over the limit without noticing. When that happens, SPF fails for every email you send, not just the ones from the newest tool.
The SPF checker counts your lookups for you and warns you when you're getting close.
Then turn on DKIM and DMARC
SPF on its own is only part of the job. Google Workspace also supports DKIM, which signs every message you send. Generate the key in the Admin console under Gmail's "Authenticate email" setting, add the record it gives you to your DNS, then switch on signing. And a DMARC record tells receivers what to do when a message fails both checks.
Our guide to SPF, DKIM and DMARC explains how the three fit together and the order to set them up in. Once DMARC is in place, the DMARC checker will confirm the policy is being read correctly.
How to check it's working
Two quick checks:
- Run the SPF checker on your domain. You want exactly one SPF record that includes
_spf.google.com, ends in~allor-all, and stays under 10 lookups. - Send yourself a test email to a personal Gmail address, open it, and choose "Show original" from the three-dot menu. Near the top you'll see an SPF result. You're looking for
PASS.
If the checker says the record is fine but your test email still fails SPF, the message is probably being sent from somewhere other than Google, such as a contact form or a third-party tool, and that sender needs adding to the record.