[MUSIC PLAYING]
SPEAKER: In this video, we'll take you through the steps
to set up email authentication for your email servers.
Setting up email authentication helps
prevent messages your organization sends
from being flagged as spam.
In the next few minutes, we'll show you
how to set up SPF and DKIM for your organization.
We'll also give you an overview of DMARC, an additional layer
of email authentication security that you
can set up for your domain.
Before setting up your SPF or DKIM records,
you can check and see if they've already
been set up for your domain.
You can perform this check by going to the Check MX page
of your Google Admin toolbox.
Enter your domain name and click "RUN CHECKS!"
to see the current status of your SPF and DKIM records
and if they've already been set up.
After completing the checks, you will get a summary
with flags showing if mail flow is, one working smoothly
and no action is needed, two, working but indicating
issues that need to be addressed, or three,
needs to be set up.
If your SPF or DKIM records are not currently set up,
you can do it using our step-by-step in the Google
Workspace Help Center.
Although Google provides a default DKIM configuration
for your domain, for best security,
we recommend that you create your own DKIM key.
We'll talk about how to do that later in this video.
Now that you know the basics and checked
to see if SPF and DKIM are already set up,
if you still need help, we'll take you
through the setup steps.
The first step to setting up your SPF
is to create your TXT record.
A TXT record defines the mail servers
that are allowed to send mail for your domain.
A single domain can have only one TXT record for SPF.
However the SPF TXT record for a domain
can specify multiple servers and domains
that are allowed to send mail for the domain.
If all email from your organization
is sent from Google Workspace, use this line
of text for your TXT record--
v=spf1 include:_spf.google.com ~all.
If you send mail in other ways in addition
to Google Workspace, you must create a custom TXT
record for SPF.
The Google Workspace Help Center has more details
about how to format TXT record contents,
depending on how email is sent from your organization.
After you create your TXT record,
you can enable SPF for your domain
by adding your TXT record for SPF at your domain provider.
To add your TXT record for SPF, you
need to sign into the Management Console for your domain host.
Don't worry if you don't know your domain host.
In the Google Workspace Help Center,
you can search for instructions on how to find your domain
host online.
After you sign into the Management Console
for your domain host, find the page
where you can update TXT records for your domain.
Here, you can add the standard TXT record for Gmail servers
we showed you earlier, or a custom TXT record you
created for your mail servers.
Your SPF is now set up.
It's also important to note that you should update your TXT
record for SPF at your domain provider
if you add new mail servers to your organization
or start using new third-party senders.
Now that you know how to set up SPF,
the next video will show you how to set up DKIM.
The first step to setting up your DKIM
is to generate a DKIM key for your domain.
Google recommends that you use your own DKIM
key on all outgoing messages.
However, if you don't generate your own DKIM domain key,
Gmail signs all outgoing messages
with a default DKIM domain key for messages sent
from mail.google.com servers.
It's important to note that after you create your Google
Workspace account and turn on Gmail,
you must wait 24 to 72 hours before you can generate a DKIM
key.
To generate this domain key, you need
to sign into your Google Admin Console
and go to the Gmail Settings page.
At the Gmail Settings page, click "Authenticate email."
From the menu, select the domain where you'll be using DKIM,
and then click the "GENERATE NEW RECORD" button.
Next, you will be asked to select the DKIM key bit length.
The longer option, 2,048-bit keys,
is more secure and recommended if your domain host will
support it.
Otherwise, you can select the 1,024-bit key option.
You're also asked for your prefix selector.
Domain keys include a text string
called the prefix selector, which you can modify
when you generate the key.
The default prefix selector for the Gmail domain key
is "google."
You should change this prefix only if your domain already
uses a DKIM key with the prefix selector "google."
After selecting your bit key length and prefix selector,
click Generate to receive a DKIM key for your domain.
The next step is to add your new DKIM domain
key to your domain DNS or domain name system record
at your domain host.
You'll need to be signed into the dashboard for your domain
host.
On the dashboard for your domain host,
locate the page where you can update DNS records.
Add the new TXT record with the DKIM domain
key you just generated and save your changes.
It can take up to 48 hours for email authentication to begin.
Until then, your Google Admin Console
will continue to show a message about updating the DNS
records for this domain.
The final step to setting up your DKIM,
after you've generated your domain key
and added the key to your domain record,
is to turn on DKIM signing.
You must be signed into your Google Admin Console
to turn on DKIM signing.
From the Admin Console homepage, click Apps,
Google Workspace, and finally, Gmail.
On the Gmail Settings page, click "Authenticate email."
Select the domain where you want to start email signing
and then click the "Start Authentication" button.
Remember.
It can take up to 48 hours for email authentication to begin
While not required to send mail successfully,
we recommend you set up DMARC to further protect your email
accounts from spam, spoofing, and phishing.
DMARC, or Domain-based Message Authentication, Reporting,
and Conformance, helps you manage messages that
are checked by SPF and DKIM.
When a message doesn't pass SPF or DKIM,
DMARC lets you decide what happens to the message next.
You can deliver it normally, reject the message,
or send it to spam.
The daily reports you get with DMARC
help you identify any potential issues with your email,
like suspicious messages or issues with authentication.
We've tried to make setting up DMARC as easy as possible,
but some steps can be complex.
We'll help you through each step when
you follow the instructions in the Google Workspace Help
Center.
SPF, DKIM, and DMARC are all standards
that solve different pieces of the email authentication puzzle
by strengthening the security of your domain
and the reliability of your email delivery.
For more information on setting up your SPF, DKIM, and DMARC,
please visit the "Help Prevent Spoofing, Phishing, and Spam"
topic in the Google Workspace Admin Help Center.