MailFixIt

Google Workspace email configuration guide

Google Workspace: SPF record for provider sending

The SPF policy may not authorize Google Workspace for the envelope sender that the receiver evaluated.

Problem description

A provider setup symptom may look like:

SPF record for provider sending after a provider DNS change.

Check the sending domain

What this usually means

The SPF policy may not authorize Google Workspace for the envelope sender that the receiver evaluated.

Fix it

  1. Confirm that Google Workspace or its configured SMTP relay actually sends for this envelope domain. Use Google’s current SPF mechanism from the Admin documentation, not a copied policy from another domain.
  2. Read a recent message header or bounce to find the envelope MAIL FROM domain.
  3. At that exact DNS name, locate the single TXT policy beginning with v=spf1.
  4. Merge the provider mechanism into that policy and preserve all other services that still send legitimate mail.
  5. Publish the result, send a new test, and confirm spf=pass for the expected domain and sending IP.

Common mistake

A domain may publish only one SPF policy at a given name. A second SPF TXT record creates a permanent evaluation error; replacing the first can silently remove another valid sender.

What MailFixIt can check

MailFixIt can expose missing, conflicting, or invalid public SPF records. It cannot activate a Google Workspace account or create a mailbox.

Use the related guides for the exact DNS or authentication warning, then test the same mail path again.

Frequently asked questions

What does MailFixIt check for Google Workspace?

It checks the public SPF route and visible conflicts. The provider console must confirm account readiness, and a new delivery or message header must confirm the result.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Google Workspace SPF setup.