Add a single TXT record at your domain apex: v=spf1 include:_spf.google.com ~all. That’s it — Google Workspace’s include: mechanism covers every Google-controlled sending IP. If you also send from other services (SendGrid, Mailchimp, HubSpot), add their includes: v=spf1 include:_spf.google.com include:sendgrid.net ~all. Publish the record via your DNS host (Cloudflare, Route 53, GoDaddy, etc.) as a TXT record on the root domain. Verify with the email authentication checker — it should show SPF=Pass within 5-30 minutes. Watch the 10-DNS-lookup limit if you add multiple includes.
All questions
How do I set up SPF for Google Workspace?
Read the full guide
What Is an SPF Record?
SPF tells the world which servers are allowed to send email on behalf of your domain. A missing or misconfigured SPF record lets spammers forge your address — and sends your legitimate email straight to spam.