DMARC setup for Google Workspace

SPF has a hard limit of ten DNS lookups, and every include statement consumes lookups. Organisations that have accumulated a CRM, a mail marketing platform, an invoicing tool and a helpdesk over several years frequently exceed it without knowing, at which point SPF evaluation fails permanently and silently.

Only one SPF record may exist per domain. Two records is a configuration error, not a redundancy, and it causes a permanent error rather than a fallback. Auditing and flattening the existing record is the first task, before DKIM or DMARC enters the conversation.

A DMARC record with p=none changes nothing about mail delivery. What it does is instruct receiving providers to send you aggregate reports about every source sending as your domain. Those reports are the inventory you never had, and they routinely surface three to six legitimate senders nobody remembered.

Two to four weeks of collection is enough for most organisations. Seasonal senders such as annual invoicing or recruitment campaigns argue for longer. Enforcement before that inventory exists is exactly how a company blocks its own payroll notifications.

The path is p=none, then p=quarantine with a percentage, then p=reject. The percentage tag matters: quarantining ten per cent of failing mail tells you what enforcement will do while limiting the damage if you have missed a sender. Increase in stages, watching reports at each step.

Alignment is the subtlety that catches people. A sender can pass SPF and still fail DMARC because the domain that passed is not the domain in the visible From header. Third-party platforms usually need a custom sending subdomain and their own DKIM key to align properly, which is a configuration change on their side, not yours.

Enforcement stops other people sending invoices in your name, which is the mechanism behind most supplier payment fraud aimed at your customers. That is the security argument. The deliverability argument is separate and increasingly forceful: major mailbox providers now apply authentication requirements to bulk senders, and unauthenticated mail is treated with growing suspicion.

For organisations that send transactional mail, missing authentication shows up as quiet revenue loss long before anyone reports it as a security problem. The mail does not bounce; it lands in spam, and nobody tells you.