A Workspace domain should publish one SPF policy for each relevant DNS name, with all authorized senders represented in that policy. Adding a second separate SPF record for another provider can cause an authentication error.
Inventory senders before editing DNS
Identify Google Workspace, marketing platforms, ticketing systems, website forms, and other services that send using the domain. Save the existing DNS record and confirm who owns each sending route.
If Google Workspace is the only sender, Google’s example is v=spf1 include:_spf.google.com ~all. It is an example for that condition, not a safe replacement for every organization’s existing policy.
Combine the authorized mechanisms carefully
Edit the existing SPF TXT policy rather than publishing several v=spf1 records at the same name. Use each provider’s current official mechanism and preserve legitimate existing senders.
SPF has a limit of ten DNS-query-causing terms during evaluation, including relevant nested lookups. It is not enough to count only the visible include statements. Use appropriate diagnostics before saving a combined policy, and do not authorize broad address ranges without a business reason.
Verify DNS and actual mail
Check the authoritative and publicly visible DNS result using the provider’s required host-name format. Avoid accidentally creating a record at a doubled domain name. Google notes that SPF changes can take up to 48 hours to start working.
Send controlled tests through each legitimate sending service and inspect the recipient-side authentication results. Passing SPF does not by itself establish DMARC alignment, and forwarding can change which server SPF evaluates. Keep DKIM and DMARC in the broader authentication plan. Do not change to an unrestricted +all policy to eliminate errors; that would authorize arbitrary senders rather than repair the actual configuration.
Browse Gmail & Google Account help
References
- Set up SPF | Apps & integrations | Google Workspace Help
- About SPF records | Security & data protection | Google Workspace Help
- RFC 7208: Sender Policy Framework (SPF)
Reviewed against the linked product guidance, standards, and identified vendor or public-authority guidance on October 29, 2026. Available options and screen labels can vary by account, device, region, and organization policy.