How to Set Up SPF for Google Workspace (Step-by-Step)

Setting up SPF for Google Workspace takes about 5 minutes plus DNS propagation. You publish one TXT record listing Google’s SPF include, wait a few minutes, and verify.

Prerequisites

You have Google Workspace configured with your domain as the primary
You have access to your DNS host (Cloudflare, Route 53, GoDaddy, Namecheap, etc.)
You know the current SPF record — if any — on your domain (check with the SPF lookup tool)

Step 1 — Decide on Your SPF Value

If Google Workspace is your ONLY sender:

v=spf1 include:_spf.google.com ~all

If you send from Google Workspace plus other providers (SendGrid, Mailchimp, HubSpot):

v=spf1 include:_spf.google.com include:sendgrid.net include:_spf.hubspot.com ~all

Watch the SPF 10-DNS-lookup limit. Each include: consumes lookups (Google’s include chain uses 3 lookups by itself). Exceed 10 and SPF returns PermError — worse than no SPF at all.

Choose the ending mechanism:

~all (soft-fail) — recommended while testing. Non-authorized senders flagged, not rejected.
-all (hard-fail) — recommended after 30+ days of clean data. Non-authorized senders rejected outright.

Start with ~all, verify no legitimate mail is failing, then tighten to -all.

Step 2 — Publish the TXT Record

At your DNS host, add a TXT record:

Name / Host — @ or your root domain
Type — TXT
Value — v=spf1 include:_spf.google.com ~all (quotes optional depending on host)
TTL — 3600 (1 hour) — Auto is fine

If you already have an SPF record — replace it. You may have only ONE SPF TXT record per domain.

Provider-specific: our Cloudflare TXT guide and Route 53 TXT guide cover the UIs.

Step 3 — Verify

Wait 5-30 minutes for DNS propagation. Then verify with the SPF lookup tool — should return SPF=Pass with the published record shown.

Also check with the email authentication checker — a full SPF + DKIM + DMARC sanity run.

Step 4 — Send a Test Message

Send from a Google Workspace account to an external inbox (Gmail personal, Outlook.com). Open the message headers:

Authentication-Results: mx.google.com;
    spf=pass (google.com: domain of [email protected] designates ...)

spf=pass = you’re done. spf=softfail or spf=fail = review the record; something else is sending mail as your domain that isn’t included.

Step 5 — After 30 Days, Tighten

If aggregate reports (from your DMARC RUA) show only legitimate senders passing SPF, change ~all to -all in your TXT record. Republish. Now non-authorized senders are outright rejected.

Common Miss

Having TWO SPF records — causes PermError. Merge into one.
Missing include:_spf.google.com — Google’s servers fail SPF for your domain.
Chaining too many includes — 10-lookup limit exceeded.
Wrong location — SPF goes at the root domain, not at a subdomain like mail.yourdomain.com.

Follow up by setting up DKIM for Google Workspace and DMARC for Google Workspace.

Read what an SPF record is, check the SPF glossary entry, and follow up with how to set up DMARC for Google Workspace.