Configuring SPF, DKIM, and DMARC for Google Workspace and Microsoft 365

22 October 2026

Most brands send from an office suite first. Publish that suite’s SPF and DKIM correctly, merge carefully if both Google and Microsoft send, then put one organizational DMARC record in place before you chase marketing ESPs.

Google Workspace

Admin → Apps → Google Workspace → Gmail → Authenticate email.
Generate a 2048-bit DKIM key. Publish the TXT at google._domainkey, then Start authentication.
SPF must include include:_spf.google.com once in the merged apex record.

Type	Name / host	Value / points to	Note
`TXT`	`@`	`v=spf1 include:_spf.google.com -all`	Merge with other includes; stay under 10 lookups.
`TXT`	`google._domainkey`	`(value from Admin console)`	Default selector name is google.

Microsoft 365

Exchange / Defender admin → DKIM / email authentication for the domain.
Publish both selector1 and selector2 CNAMEs under ._domainkey, then enable signing.
SPF must include include:spf.protection.outlook.com.

Type	Name / host	Value / points to	Note
`TXT`	`@`	`v=spf1 include:spf.protection.outlook.com -all`	If Google also sends, merge both includes into one TXT.
`CNAME`	`selector1._domainkey`	`(from Microsoft admin)`	Keep selector2 for rotation.
`CNAME`	`selector2._domainkey`	`(from Microsoft admin)`

One DMARC for the brand

Prefer a single record at _dmarc.brand.example. Self-manage with p=none and your own rua, or use Hosted DMARC (CNAME only—DNS only on Cloudflare). Detail pages: Google Workspace, Microsoft 365.

If the merged SPF crosses ten DNS lookups, fix that before enforcement—see SPF PermError.