Google Workspace SPF record

Google Workspace (Gmail) publishes _spf.google.com, which itself nests several _netblocks includes. In practice it consumes about three to four of your ten DNS lookups — more than most people expect.

The SPF include for Google Workspace

Authorize Google Workspace by adding its mechanism to your single SPF TXT record:

v=spf1 include:_spf.google.com ~all

Approximate lookup cost: 3–4 DNS lookup(s). Remember you have a budget of 10 total across every sender in the record.

Provider include values change occasionally. Confirm the current value in your Google Workspace admin console before publishing, and never create a second v=spf1 record — a domain may have only one. Combine all senders into one record:

v=spf1 include:spf.protection.outlook.com include:_spf.google.com ~all

Because Google’s include is nested, it eats a meaningful chunk of your budget before you add anything else. Pair it with one CRM and a marketing tool and you are frequently at or over the limit.

When adding Google Workspace pushes you over the limit

Every include you stack — your mailbox provider, this one, a marketing tool, a help desk — adds to the same 10-lookup budget. The moment recursive expansion crosses 10, receivers return permerror and your SPF stops passing. You cannot shrink the nested provider records, so the durable fix is to flatten the record or move to a single-lookup macro that stays in sync automatically.