Loading
Google Workspace provides powerful email security features, but many of them are not enabled by default. This guide walks you through every setting you need to configure to fully protect your organization.
Get Expert Configuration HelpSPF Record
Authorize senders
DKIM Signing
Sign outgoing email
DMARC Policy
Enforce authentication
Admin Settings
Advanced protections
Google Workspace sends email through its own servers. You need an SPF record that authorizes these servers to send on behalf of your domain.
Add the following TXT record to your DNS:
If you send email through additional services, add them as well. For example, with HubSpot and SendGrid:
Type
TXT
Host/Name
@
TTL
3600
Google Workspace can generate DKIM keys for your domain. You need to generate the key in the admin console, publish it in DNS, and then activate signing.
Some DNS providers have a character limit on TXT records. If your 2048-bit key is too long, you may need to split it across multiple strings within the same record, or some providers handle this automatically. Check your DNS provider documentation.
With SPF and DKIM configured, publish a DMARC record to tie everything together. Start in monitoring mode.
Type
TXT
Host/Name
_dmarc
TTL
3600
Monitor reports for 2-4 weeks, then progress through quarantine to reject once all legitimate senders pass authentication. Google recommends this phased approach in their own documentation.
Google Workspace includes advanced phishing protections that go beyond standard authentication. These settings are found in the Admin Console under Safety settings and are critical for comprehensive protection.
In Admin Console > Apps > Google Workspace > Gmail > Safety:
Enable these attachment and link protections:
Beyond email authentication and phishing protection, configure these additional settings to harden your Google Workspace environment.
Our cybersecurity team configures email security for Google Workspace organizations every day. We can audit your current setup, fix misconfigurations, and deploy full DMARC enforcement.
Explore Email Security ServicesOne email per month with our best articles. No spam.