Exercise 15: Email security practices

Step 3

If you did not purchase the domain as part of the sign up flow and the domain you are using is for training only, you can add the SPF record as shown above to your DNS records. 

Step 4

You can check which IP addresses are covered by _spf.google.com using the Check MX utility. Perform the lookup and then click the Effective SPF Address Ranges link in the results. Try that now but remember it can take a while for DNS record changes to propagate.

-- --

Part 2: Set up DKIM

Step 1 - Check if DKIM is already set up

How you perform this check depends on whether you’re using Google Workspace. If you’re using Google Workspace, follow the instructions in this section. If you’re not using Google Workspace, check with your email and/or ISP (if your ISP is the domain that sends email). If you manage your own email, use one of the tools available on the internet.

1. Navigate to the Google Admin Toolbox at https://toolbox.googleapps.com/apps/checkmx/.

2. Enter your domain in the Domain name field.
   Note: In some cases, you might need to enter your DKIM prefix selector, which uniquely identifies the DKIM key. The default is google.

3. Click Run Checks.

4. When the test finishes, check for one of these messages:

• DKIM authentication DNS setup: A DKIM key is set up for the domain and selector. Skip Steps 2 and 3.

• DKIM is not set up: There's no DKIM key for your domain with the prefix selector you entered. Continue to step 2 to set up a new key using the provided selector.

Step 2 - Generate a DKIM key pair

1. If you’re not already signed in, sign in to your domain as the Administrator at admin.google.com.

2. From the main menu, navigate to Apps, select Google Workspace, and then click Gmail.

3. Click Authenticate email, and ensure that STATUS is set to Authenticating email. It can take between 24 and 72 hours for DKIM to become fully activated.

4. Navigate back to your domain registrar. If you purchased your domain through Google, locate your google._domainkey TXT record in your DNS records. It should match the one shown in the Admin console. If you brought your own domain to Google Workspace, click GENERATE NEW RECORD, then click GENERATE in the dialog box that appears.

5. Copy the DKIM values shown in the Authenticate email window. You’ll add it at your domain provider in the next step:

Step 3 - Add the DKIM key to your domain

Once you’ve generated your DKIM key pair, add the public DKIM key to your domain by creating a DKIM TXT record.

For help with your domain sign-in information, settings, or TXT records, contact your domain provider. Google doesn't provide technical support for third-party domain providers.

To add the DKIM key from your Google Admin console to your domain provider's DNS records:

1. Go to the page where you update DNS TXT records for your domain. For help finding this page, check the documentation for your domain.

2. Add or update the TXT record with the type, host, value, and TTL from the previous step.

3. Save your changes.

4. If you use subdomains, check with your domain provider to find out how to add a TXT record for subdomains. 

5. If you’re setting up DKIM for more than one domain, complete these steps for each domain. You must get a unique DKIM key from the Admin Console for each domain.
   After adding a DKIM key, it can take up to 48 hours for DKIM authentication to start working.

6. Return to the Admin console, and click START AUTHENTICATION. When you turn on email signing, Gmail verifies you have a DKIM domain key. If the DKIM domain key is not found, Google Workspace displays a warning message so you should try again later.

-- --

Part 3: Set up DMARC

Step 1

From your domain registrar, locate your DNS records and add a DMARC TXT record as shown below. Replace yourdomain with your Google Workspace primary domain name, and admin-email with your administrator's email address.