Which DNS records does Google Workspace need?
An MX record smtp.google.com with priority 1, an SPF TXT record with include:_spf.google.com, a DKIM TXT record at google._domainkey with the key from the Admin console, and a DMARC record. A google-site-verification TXT record proves you own the domain.
| Record | Name | Value |
|---|---|---|
| MX | @ | smtp.google.com, priority 1 (domains set up before 2023 may use aspmx.l.google.com and its four backups, still supported) |
| TXT (SPF) | @ | v=spf1 include:_spf.google.com ~all |
| TXT (DKIM) | google._domainkey | v=DKIM1; k=rsa; p=<key from the Admin console> |
| TXT (DMARC) | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@example.com, then quarantine and reject |
| TXT | @ | google-site-verification=…, to verify the domain |
| CNAME (optional) | ghs.googlehosted.com, opens Gmail at mail.example.com |
Generate the DKIM key in the Google Admin console (Apps, Google Workspace, Gmail, Authenticate email), publish it, then press Start authentication.
How the check works
DNS cannot list every name in a domain, so the checker asks the names Google documents: the domain's MX and TXT records, google._domainkey (or the prefix you type), _dmarc, and mail, calendar, drive and sites for custom web addresses. SPF is followed through every include, so a Google include reached through another one counts too.
Your browser asks Cloudflare's public resolver directly. Nothing goes through webdave, and the checker never signs in to your Google account, so it sees only what the whole internet sees.
Questions
You do not have to. Google says the older five-record set still works. The single smtp.google.com record does the same job and is what Google gives new domains.
Either DKIM was never set up, or it uses another prefix than google. Find the selector in a sent message's headers (the s= value of DKIM-Signature) and type it in the selector field.
Both work. Google's own example ends with ~all. With DMARC at quarantine or reject, ~all is enough; -all is stricter.
Usually minutes, at most the old record's TTL. Google says up to 72 hours. Check again here: this page keeps answers for at most five minutes.