InboxAudit

Google Workspace email authentication

Google’s business email (formerly G Suite), the most common mailbox host for small and mid-size companies.

SPF record

Add Google Workspace to your domain's SPF record with this include:

include:_spf.google.com

A complete record for a domain sending only through Google Workspace:

v=spf1 include:_spf.google.com ~all

What it costs you

1 of your 10 DNS lookups. That is the cheapest an include can be — the record it points at contains only IP ranges, with no further includes to follow. Behind it are 8 IP ranges.

Live record

This is what _spf.google.com published when this page was generated:

v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all

Domains using Google Workspace

Found while resolving 293 well-known domains on 2026-08-04 — each authorises _spf.google.com in its published SPF record:

DKIM

Enable DKIM inside Google Workspace and publish the selector record it generates. DKIM matters more than SPF for deliverability, because a DKIM signature survives forwarding while SPF does not — see how selectors work.

DMARC

Neither SPF nor DKIM protects the address your recipients actually see until DMARC ties them to it. Once Google Workspace is authenticating, publish a DMARC record — start at p=none with a reporting address and tighten from there.

Generate a DMARC record →

Check it worked

DNS changes take minutes to hours to propagate. Once published, run the domain through the checker — it resolves the full include chain and reports the real lookup count.

Official documentation

Google Workspace setup docs →