FmindEmail security
Set up SPF for Google Workspace
SPF lets receiving mail services check whether a server is allowed to send for a domain. Start with a complete list of your senders so a DNS change does not disrupt legitimate mail.
Who can act: your Google Workspace administrator and the person who manages your domain’s DNS records.
1. List your sending services
Include newsletters, invoices and website forms, even if your inbox is on Google Workspace. Ask each provider for its current SPF instructions and the domain it uses for the return address, shown as Return-Path. Google’s SPF setup guide
2. Check the existing policy
At your DNS provider, save the existing TXT records before editing. If one starts with v=spf1, update that policy with your administrator instead of adding another. Preserve authorized senders and existing protection, as well as MX, DKIM and unrelated TXT records.
SPF normally checks the envelope sender’s domain (Return-Path), which can differ from the visible From address. A sending subdomain needs its own policy; SPF does not automatically inherit its parent’s record. How SPF identifies the sending domain
3. Publish the right TXT value
Use this example only when Google Workspace is your only sending service and no SPF policy already exists for that domain:
v=spf1 include:_spf.google.com ~allFor the root of your domain, providers commonly use @ or a blank host field; follow your provider’s instructions. Do not put this record at _dmarc or automatically at www.
The ~all ending marks unlisted servers as softfail; the receiver decides how to handle their mail. Keep exactly one SPF policy per sending domain. Understand SPF record values
With several senders, ask your administrator to check the limit of 10 DNS-querying terms across the whole evaluation, including nested include and redirect rules. Counting only the includes you can see is not enough. SPF lookup limits
4. Verify DNS and real messages
Changes can take up to 48 hours. Ask your administrator to check the published TXT records, replacing example.com with the domain used by SPF:
dig +short TXT example.comSend from each service to a separate external mailbox you control. In the receiving service’s original message headers, check spf=pass and the evaluated domain. A DNS record alone does not prove authentication or inbox delivery. Verify and troubleshoot SPF with Google
Forwarding can break SPF. Set up DKIM and DMARC too: a pass for a provider’s own domain does not by itself protect your visible From address. Set up DMARC for Google Workspace