Google Workspace email security
and DMARC setup.Strengthen your email security foundation.
Protect your domain reputation and eliminate spoofing risks with Suitebriar’s DMARC, DKIM, and SPF implementation services. We help organizations configure security policies, monitor enforcement, and reduce phishing exposure.
Trusted by teams at
How do you set up DMARC for Google Workspace?
Set up SPF and DKIM first and wait 48 hours. Then publish a DMARC record at _dmarc on your domain with the policy at none, read the reports for a week, and move to quarantine a small percentage at a time until it covers all failing mail.
SPF lists the servers allowed to send as your domain. DKIM signs each message, and in Google Workspace it stays off until someone generates the key in the Admin console and starts authentication. DMARC tells receiving servers what to do with mail that fails, and sends you reports. The hard part of Google Workspace email security is everything else that sends as your domain: the CRM, the marketing platform, the billing system. Each one has to pass before the policy is enforced, or your own mail lands in spam.
How Connections Health secured its email without an IT team
Connections Health, a therapy practice, already ran on Google Workspace and wanted to understand its security features and secure its email. Suitebriar ran a Google Workspace security audit over several meetings, recommended DMARC, and set up DKIM and DMARC at the highest level of security the practice's business allowed.
Read the story“We appreciated the detailed technical explanations. We don't have an in-house IT professional so it was great that they took the time to explain the technical aspects of our security audit. The security audit involved several meetings over time and they were very patient with our schedules, last-minute changes, and cancellations. They were always willing to adapt and re-schedule to meet.”
How DMARC gets to enforcement
- Find every senderGoogle Workspace, plus every service that sends as your domain: CRM, marketing, billing, support desk. Each needs to pass SPF or DKIM.
- Set up SPF and DKIMOne SPF record with an include for each sender, and a DKIM key generated in the Admin console. Both can take up to 48 hours to start working.
- Monitor at p=noneMail is delivered as normal while the reports show which senders fail. Google suggests a week of daily review; failing senders get fixed now.
- Enforce in stepsQuarantine a small percentage of failing mail and raise it to all of it. Reject is the last step: rejected mail is never delivered.
