SPF for Google Workspace: The Complete Setup Guide

Google Workspace (formerly G Suite) is one of the most popular business email platforms. Setting up SPF correctly ensures your emails from Google Workspace land in inboxes instead of spam folders. This guide walks you through the exact configuration.

The Google Workspace SPF Include

To authorize Google Workspace to send email for your domain, you need to add Google's SPF include statement to your SPF record:

include:_spf.google.com

That's it. This single include statement authorizes all of Google's mail servers to send email on your behalf.

Setting Up SPF for Google Workspace

If you don't have an existing SPF record, here's what to create:

v=spf1 include:_spf.google.com ~all

This tells receiving servers:

• v=spf1 — This is an SPF record
• include:_spf.google.com — Google's servers are authorized to send
• ~all — Soft fail on anything else (treat with suspicion but don't reject)

Once you're confident your setup is complete, you can change ~all to -all for stricter enforcement.

Adding Google to an Existing SPF Record

Already have an SPF record? You need to add Google's include to it—not create a second SPF record.

Example: Adding Google to an existing record

If your current record is:

v=spf1 include:sendgrid.net ~all

Your updated record should be:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

The order of include statements doesn't matter. Just make sure you keep the v=spf1 at the beginning and the all mechanism at the end.

Steps to update:

1. Log into your DNS provider (domain registrar or DNS host)
2. Find your existing TXT record that starts with v=spf1
3. Edit the record to add include:_spf.google.com
4. Save the changes
5. Wait for DNS propagation (usually 1-4 hours)

If you need help building or updating your SPF record, SPF Creator can generate the correct syntax.

Common Google Workspace SPF Mistakes

Using the wrong include domain

Make sure you use exactly _spf.google.com. Common mistakes include:

• spf.google.com (missing the underscore)
• _spf.gmail.com (wrong domain)
• google.com (too generic)
• googlemail.com (incorrect)

Only _spf.google.com is correct for Google Workspace.

Creating multiple SPF records

A common error is creating a new SPF record instead of editing the existing one. This results in two TXT records starting with v=spf1, which causes SPF evaluation to fail with a PermError.

Wrong approach (two separate records):

v=spf1 include:sendgrid.net ~all
v=spf1 include:_spf.google.com ~all

Correct approach (single combined record):

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Forgetting to update SPF when migrating to Google Workspace

If you're migrating from another email provider to Google Workspace, remember to:

1. Add Google's include statement
2. Keep your old provider's include (temporarily, if still sending)
3. Remove the old provider's include after migration is complete

Not accounting for DNS lookup limits

Each include statement counts toward the 10 DNS lookup limit. Google's _spf.google.com itself requires about 3-4 lookups (it references additional includes internally). If you have many email services, you might hit the limit.

Check our guide on the SPF 10 DNS lookup limit if you're running into this issue.

Verifying Your Google Workspace SPF Setup

After making changes, verify that your SPF record is correctly configured.

Check the record exists

Use the lookup tool above or run a DNS query to confirm your record is published and contains include:_spf.google.com.

Send a test email

Send an email from your Google Workspace account to a personal Gmail or other email address. Then check the email headers for the SPF result.

In Gmail, open the email and click the three dots → "Show original." Look for:

spf=pass (google.com: domain of you@yourdomain.com designates [IP] as permitted sender)

If you see spf=pass, your configuration is working.

Check authentication reports

If you have DMARC set up with reporting enabled, your DMARC reports will show SPF pass/fail rates. This gives you ongoing visibility into authentication success.

Google Workspace with Other Email Services

Most businesses use more than just Google Workspace for email. You might also use:

• Marketing platforms like Mailchimp, HubSpot, or Constant Contact
• Transactional email services like SendGrid, Mailgun, or Amazon SES
• CRM systems like Salesforce that send email on your behalf
• Support tools like Zendesk or Intercom

Each service needs to be in your SPF record. Here's an example combining several:

v=spf1 include:_spf.google.com include:sendgrid.net include:spf.mandrillapp.com ~all

SPF, DKIM, and DMARC for Google Workspace

SPF is just one part of email authentication. For complete protection, you should also set up:

DKIM — Google Workspace supports DKIM signing. In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email. Generate your DKIM key and add it to your DNS.

DMARC — Once SPF and DKIM are working, implement DMARC to tell receiving servers how to handle emails that fail authentication. Check your DMARC setup with a DMARC checker.

Together, these three protocols provide strong email authentication that protects your domain from spoofing and improves deliverability.

Troubleshooting Google Workspace SPF

Emails still going to spam after setting up SPF

SPF is one factor among many. Check:

• Is DKIM also configured?
• Is your domain reputation good?
• Are you following email best practices (no purchased lists, proper unsubscribe links, etc.)?

SPF validation shows neutral or none

Your SPF record may not be published yet (DNS propagation) or there's a syntax error. Double-check your DNS settings.

PermError in SPF results

This usually means you have multiple SPF records or you've exceeded the 10 DNS lookup limit. Check for duplicate records and optimize if needed.

Monitor Your SPF Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.