Add this TXT record to your domain's DNS: v=spf1 include:_spf.google.com ~all. If you have other email senders, combine them: v=spf1 include:_spf.google.com include:sendgrid.net ~all. Google Workspace's SPF include authorizes all Google mail servers. Verify with dig or MXToolbox after DNS propagation.
SPF for Google Workspace: Complete Setup Guide
The Google Workspace SPF Record
For Google Workspace (formerly G Suite), use this SPF include:
include:_spf.google.com
If Google Workspace is your only email sender, your complete record is:
v=spf1 include:_spf.google.com ~all
This authorizes all Google mail servers to send email on behalf of your domain.
Step 1: Check for Existing SPF
Before adding anything, check if you already have an SPF record:
dig TXT yourdomain.com +short | grep spf
Or use MXToolbox SPF Lookup.
If you have an existing record: Don't create a second one—you'll cause a permerror. Modify the existing record to include Google.
If no record exists: Create a new TXT record.
Step 2: Add the DNS Record
Log into your DNS provider and add a TXT record:
| Field | Value |
|---|---|
| Host/Name | @ or blank (root domain) |
| Type | TXT |
| Value | v=spf1 include:_spf.google.com ~all |
| TTL | 3600 (or default) |
DNS Provider Examples
Cloudflare:
- DNS → Add record
- Type: TXT
- Name: @
- Content:
v=spf1 include:_spf.google.com ~all
GoDaddy:
- DNS Management → Add
- Type: TXT
- Host: @
- TXT Value:
v=spf1 include:_spf.google.com ~all
Namecheap:
- Advanced DNS → Add New Record
- Type: TXT Record
- Host: @
- Value:
v=spf1 include:_spf.google.com ~all
Step 3: Combining with Other Senders
Most organizations use Google Workspace alongside other email services. Combine them in one record:
Google Workspace + SendGrid:
v=spf1 include:_spf.google.com include:sendgrid.net ~all
Google Workspace + Mailchimp:
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all
Google Workspace + HubSpot + SendGrid:
v=spf1 include:_spf.google.com include:_spf.hubspot.com include:sendgrid.net ~all
Practitioner note: Google's SPF record uses 3-4 of your 10 allowed DNS lookups. When adding other ESPs, verify the total count doesn't exceed 10. I've seen plenty of "SPF permerror" issues from agencies who added Google + 3 marketing tools without checking.
Step 4: Verify the Record
Wait 15-30 minutes for DNS propagation, then verify:
Using dig:
dig TXT yourdomain.com +short
You should see:
"v=spf1 include:_spf.google.com ~all"
Using MXToolbox: Search for your domain in SPF Record Lookup. Verify:
- Record is found
- Syntax is valid
- Lookup count is under 10
Step 5: Test Authentication
Send a test email from your Google Workspace account to another email (Gmail personal account works).
- Open the received email
- Click three dots → "Show original" (Gmail) or view headers
- Look for:
spf=pass (google.com: domain of [email protected] designates xxx.xxx.xxx.xxx as permitted sender)
If you see spf=pass, your SPF is working.
Common Issues
"SPF record already exists"
Don't create a second record. Modify the existing one to add Google's include:
Before:
v=spf1 include:sendgrid.net ~all
After:
v=spf1 include:_spf.google.com include:sendgrid.net ~all
"Too many DNS lookups"
Google uses 3-4 lookups. If you're already at the limit with other services, you need to:
- Remove unused includes
- Replace some includes with ip4 addresses
- Use SPF flattening
"SPF softfail in headers"
Check that the include statement is correct: include:_spf.google.com (not _spf.gmail.com or other variations).
Google Workspace SPF Lookup Details
When receivers check _spf.google.com, here's what happens:
dig TXT _spf.google.com +short
Returns nested includes like:
"v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all"
Each of those resolves to IP ranges. This is why Google's single include uses 3-4 of your 10 lookups.
Practitioner note: Google updates these IP blocks regularly as they add infrastructure. Using the include (rather than hardcoding IPs) ensures you automatically follow their changes. Never try to flatten Google's SPF manually—it changes too frequently.
Moving from Softfail to Hardfail
Once you've verified SPF works and you've added all legitimate senders:
v=spf1 include:_spf.google.com -all
The -all tells receivers to reject unauthorized senders. Do this after testing, not during initial setup.
If you need help combining Google Workspace with multiple ESPs while staying under the lookup limit, schedule a consultation.
Sources
- Google Workspace Admin Help: Set up SPF
- Google Workspace Admin Help: Troubleshoot SPF
- RFC 7208: Sender Policy Framework (SPF)
- MXToolbox: SPF Record Lookup
v1.0 · March 2026
Frequently Asked Questions
What is the SPF record for Google Workspace?
The SPF include for Google Workspace is include:_spf.google.com. A complete record looks like: v=spf1 include:_spf.google.com ~all
Do I need SPF if I only use Google Workspace?
Yes. Without SPF, receivers can't verify your emails came from authorized Google servers. SPF is required for DMARC and helps deliverability.
How do I add SPF to Google Workspace?
SPF isn't added in Google Admin Console—it's added to your domain's DNS. Log into your DNS provider (GoDaddy, Cloudflare, etc.) and add a TXT record with your SPF value.
How many DNS lookups does Google Workspace SPF use?
Google's _spf.google.com typically uses 3-4 DNS lookups due to nested includes. Plan your lookup budget accordingly—you have 10 total.
Can I use Google Workspace SPF with other ESPs?
Yes. Add multiple include statements: v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all. Watch your lookup count.
Want this handled for you?
Free 30-minute strategy call. Walk away with a plan either way.