FmindEmail security
Set up DMARC for Google Workspace
DMARC tells receiving mail services how to handle messages that fail authentication for your domain. Start by observing legitimate mail before asking receivers to block impersonation.
Who can act: your Google Workspace administrator and the person who manages your domain’s DNS records.
1. Check every service that sends your mail
Include newsletters, invoices and website forms. Set up SPF and DKIM for each sender, then allow at least 48 hours before adding DMARC.
Set up SPF for Google Workspace
Set up DKIM for your business email
In Google Admin, open Apps → Google Workspace → Gmail → Authenticate email and select your domain. If no DKIM record is shown, choose Generate New Record. Publish the displayed DNS record before starting authentication; preserve any working key. Google’s DKIM instructions
2. Publish a monitoring policy
Use the domain after @ in your outgoing From address. Create a dedicated mailbox or group there for aggregate reports. Ask your administrator to check its DMARC record and any inherited parent-domain policy. Save existing settings; this starter example must not weaken protection already in place.
Only if no DMARC policy applies, add a TXT record at _dmarc. Some providers require the full name, _dmarc.example.com; others append the domain automatically.
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comReplace the example address with the report mailbox you created. The p=none policy requests monitoring, not rejection of spoofed mail. Leave your MX and other DNS records in place. Google’s DMARC setup guide
3. Verify publication and real delivery
Ask your administrator to check the published TXT value. Replace example.com with your domain in this read-only command:
dig +short TXT _dmarc.example.comSend a test from each legitimate sender to a separate mailbox you control. In the received message’s original headers, check for dmarc=pass. DMARC needs passing SPF or DKIM aligned with the visible From domain; a DNS record alone does not prove this. Troubleshoot authentication with Google
4. Strengthen the policy after reviewing reports
Review reports daily for at least a week, covering all your sending services. Fix legitimate failures before moving gradually to quarantine, then reject. Keep monitoring delivery and restore the previous policy if a change disrupts valid mail. Google’s staged rollout