SPF for Google Workspace: setting up include:_spf.google.com the right way

For Google Workspace clients, the SPF entry you need is include:_spf.google.com. Like most SPF problems, the trouble is rarely the include itself. It's the second TXT record someone added, the forgotten web-form plugin sending as the domain, or a record that has quietly grown past the lookup limit. This page covers Google's own guidance and how to apply it as an MSP.

The record for a Google Workspace-only domain

If the client sends mail for the domain only through Google Workspace, Google's documented SPF record is:

```

v=spf1 include:_spf.google.com ~all

```

Publish it as a TXT record at the domain root (usually @ in the DNS host's interface). Google is clear that you don't configure SPF in the Google Admin console. You add the record at the domain host. Google also notes you may not need to set it up at all if SPF was configured by default or the domain was bought from a Google partner during Workspace signup. Check what's already published before you add anything.

Google says it can take up to 48 hours for SPF authentication to start working after you add the record.

Step one is an inventory, not DNS

Google's setup guide starts by identifying every server that sends mail for the domain. Its list is a useful client interview script:

• Web servers
• On-premises mail servers (for example, Microsoft Exchange)
• Mail servers used by your service host
• Outbound gateways
• Services that send automatic email, such as "Contact us" forms
• Any third-party provider or service that sends email for the domain

Ask the client, and check the domain's DMARC aggregate reports if they exist. Anything sending as the domain that isn't in SPF (or DKIM-signing with the domain) will fail once DMARC moves to enforcement.

Combining Google with other senders

There can be only one SPF record per domain. Merge every sender into it. Google publishes example combinations, including:

Before you copy these, confirm each vendor's current include from that vendor's own documentation, because vendors change them. Google also says subdomains that send mail need their own SPF record, and each domain must have its own.

~all or -all?

Google recommends ~all in Workspace SPF records. It tells receivers to treat mail from unlisted servers as suspicious (Google describes this as marking it as spam). Microsoft, for its own domains, recommends -all, so you'll see both. For a Workspace client, Google's default is fine, especially while you're still finding senders. The protection against spoofing comes from DMARC enforcement, not from the SPF qualifier alone. Never use +all, which authorizes every server on the internet.

Watch the lookup limit

Google's help says an SPF record "shouldn't include more than 10 references to other domains or servers," which it calls lookups. The exact rule comes from RFC 7208 §4.6.4. The limit is 10 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted across the whole nested include tree, not just the includes in the top-level record. Exceeding it gives permerror.

When we checked on Oct 13, 2026, _spf.google.com contained only ip4/ip6 ranges, so it used one lookup. Google can change that, and other vendors' includes often nest several levels deep, so always count the full tree.

Google's advice for keeping the record healthy is simple:

• When you add a new mail server or third-party sender, update the SPF record, or that sender's mail could be marked as spam.
• Remove domains or IPs that are no longer used for sending.

Next: DKIM and DMARC

Google recommends DKIM and DMARC for every Workspace domain, and requires SPF, DKIM, and DMARC for bulk senders (more than 5,000 messages a day to Gmail accounts). All senders to personal Gmail accounts must set up at least SPF or DKIM.

DKIM in Workspace. In the Admin console, go to Apps > Google Workspace > Gmail > Authenticate email and generate a record for the domain. Choose a 2048-bit key if the DNS host supports it. The default selector prefix is google. Publish the TXT record at the host name the console shows, then return to start authentication. Google notes that after Gmail is turned on for an organization, you may need to wait 24–72 hours before you can generate the key.

DMARC. Google says to set up DKIM and SPF at least 48 hours before DMARC. Then start at p=none with reporting, review the reports, and move toward quarantine.

MSP checklist for a Workspace client

• Exactly one v=spf1 record at the root.
• It includes include:_spf.google.com plus every other confirmed sender.
• Total lookups, counting nested includes, are 10 or fewer.
• It ends in ~all (or -all once you're confident), never +all.
• DKIM is generated in the Admin console, published, and started.
• DMARC is published with rua, with a plan to reach enforcement.

Check a Workspace domain now

Run the free SPF checker →

It walks the include and redirect tree, counts every lookup against the RFC 7208 limit of 10, names recognized senders such as Google Workspace, and flags duplicate records and risky +all or ?all endings.

Founding Partner: $1,999, one time. Track SPF, DKIM, and DMARC across all your Workspace clients. Founding Partner covers 50 client domains with full branding (logo and colors), weekly rescans and change alerts, unlimited Security Briefs (150 prospect scans a month), the Grow toolkit, the Policy library, a branded service menu, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →