Google Workspace DMARC Setup for Australian Small Business

Google Workspace DMARC setup at a glance

DMARC is an email authentication protocol that builds on SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). It instructs recipient mail servers on how to handle messages that claim to be from your domain but fail DMARC authentication, such as quarantining or rejecting them.

DMARC passes when the domain shown in the email's From address aligns with a domain authenticated by SPF or DKIM. This alignment is what allows DMARC to protect your visible business domain from direct spoofing.

Why Google Workspace DMARC setup matters for your business

DMARC uses SPF and DKIM authentication and alignment to help receiving mail systems determine whether messages claiming to use your domain are authorised. Enforcing it reduces direct domain spoofing, helping protect your reputation with clients and reduce exposure to fraudulent invoices sent using your domain. It does not prevent business email compromise involving a stolen account, display-name impersonation or a lookalike domain. Cyber insurers may ask about email authentication, but requirements vary by policy.

What happens if you do not set up DMARC?

Without a DMARC policy, receiving systems have no published DMARC instruction from you for messages that fail authentication and alignment while using your domain in the visible From address. They can still filter suspicious mail, but you lose an important domain-level control and the aggregate reports available through DMARC reporting. Successful impersonation can lead to fraudulent invoices, lost funds and damaged client relationships. If an incident also involves personal information, businesses covered by Australia’s Privacy Act may need to assess their obligations under the Notifiable Data Breaches scheme. DMARC supports broader cybersecurity controls; it does not establish compliance on its own.

How do you configure DMARC for Google Workspace step by step?

Configuring DMARC for your Google Workspace domain is a phased process: inventory your senders, authenticate them, monitor, then enforce. Work through the steps in order rather than jumping to enforcement.

1. List every service that sends email as your domain — Google Workspace, accounting and invoicing software, CRM, marketing platforms, booking systems and your website.
2. Review your existing SPF record and account for every authorised sender using each provider’s instructions. Update it where needed; never publish a second SPF record at the same name, and check SPF’s limit of 10 DNS-querying mechanisms and modifiers.
3. In admin.google.com, go to Apps > Google Workspace > Gmail > Authenticate email. Select your domain, choose Generate new record and generate a 2048-bit DKIM key where supported. Publish the supplied TXT record, allow DNS to update, then select Start authentication. Configure domain-aligned DKIM at other sending providers too.
4. Create a reporting mailbox or reporting-service address, then publish one DMARC TXT record at _dmarc using the starting value in the table. Replace the example domain and address; follow any external reporting authorisation instructions from your reporting provider.
5. Keep p=none while you analyse aggregate reports, typically for 2–4 weeks or longer to cover all sending cycles. Use a DMARC report analyser if the XML reports are difficult to read.
6. Correct failures for legitimate senders. Configure DKIM signing with an aligned domain, or an aligned envelope sender domain with valid SPF. Do not assume an SPF include alone fixes alignment.
7. Change to p=quarantine once representative mail from every known legitimate sending stream passes DMARC. Monitor reports, bounces and delivery through another representative sending cycle — often at least two weeks, and longer for monthly senders.
8. Move to p=reject when legitimate delivery remains reliable. Keep reviewing reports and test new senders before they start sending business mail.

What does DMARC cost on Google Workspace?

DMARC is an open internet standard and does not require an additional Google Workspace licence. You publish its policy in DNS and configure Google Workspace DKIM in the Google Admin console. Business Starter, Business Standard, Business Plus and Enterprise editions support this setup. Costs can include DNS hosting, staff time, professional assistance and an optional reporting service that turns XML aggregate reports into a readable dashboard. Reporting tools may offer no-cost tiers, but limits and prices vary.

Which DMARC mistakes can disrupt business email?

The most frequent error is moving straight to enforcement without accounting for every legitimate sender, which can send invoices, quotes and marketing mail to spam or cause rejection. Publishing multiple SPF records at the same DNS name causes an SPF permanent error; update the existing record instead. Another common mistake is adding an SPF include when the provider still uses an unrelated envelope sender domain — SPF may pass without aligning. Publishing Google’s DKIM key without selecting Start authentication also leaves the setup incomplete. Aggregate reports are valuable but not exhaustive: not every receiver sends them, so combine them with test messages, sender logs and bounce monitoring.

How to check DMARC is working and what to warn staff about

Send test messages from Google Workspace and every third-party sending platform to external mailboxes. Inspect the receiving system’s authentication results for spf=pass, dkim=pass and dmarc=pass. Aim to configure both SPF and DKIM correctly, while remembering that DMARC needs only one passing, aligned method. A dmarc=pass result does not prove a message is safe or guarantee inbox delivery. Before raising the policy, warn your marketing and finance teams about the change and ask them to report missing mail or bounces promptly. Investigate failures and, if legitimate delivery is disrupted, pause enforcement changes or temporarily reduce the policy while fixing the cause.

How DMARC fits into a full Google Workspace security audit

DMARC is one part of a broader email security posture, and it is a standard check in our Google Workspace security audits. Alongside email authentication we review multi-factor authentication coverage, external sharing in Drive and third-party OAuth app access. We review data loss prevention settings where your Workspace edition supports them, and identify any licensing gaps. We also review Super Admin access and delegated administrator roles to check that privileged access follows least-privilege principles and that highly privileged accounts are reserved for tasks that need them. These checks support broader cybersecurity controls; they do not establish Privacy Act or Notifiable Data Breaches compliance on their own. If you would like a second set of eyes on your configuration, book a complimentary 15-minute chat with Neil Frick to discuss what a Google Workspace security audit covers.