{"id":3497,"date":"2025-12-18T04:39:13","date_gmt":"2025-12-18T04:39:13","guid":{"rendered":"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/"},"modified":"2025-12-18T04:39:13","modified_gmt":"2025-12-18T04:39:13","slug":"google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup","status":"publish","type":"post","link":"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/","title":{"rendered":"Google Workspace vs Microsoft 365: SPF, DKIM, DMARC Setup"},"content":{"rendered":"\n<p>When it comes to email security, SPF, DKIM, and DMARC are critical tools for protecting your domain from phishing and spoofing. These protocols ensure your emails are authenticated, reducing the risk of fraudulent activity and improving deliverability. Both <strong><a href=\"https:\/\/workspace.google.com\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">Google Workspace<\/a><\/strong> and <strong><a href=\"https:\/\/www.office.com\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">Microsoft 365<\/a><\/strong> support these protocols, but their setup processes differ slightly.<\/p>\n<h3 id=\"key-takeaways\" tabindex=\"-1\">Key Takeaways:<\/h3>\n<ul>\n<li><strong>SPF<\/strong> specifies which servers can send emails for your domain.<\/li>\n<li><strong>DKIM<\/strong> ensures emails aren&#8217;t altered in transit using a digital signature.<\/li>\n<li><strong>DMARC<\/strong> provides policies for handling emails that fail SPF\/DKIM checks and enables reporting.<\/li>\n<\/ul>\n<h3 id=\"quick-highlights\" tabindex=\"-1\">Quick Highlights:<\/h3>\n<ul>\n<li><strong>Google Workspace<\/strong> simplifies setup with auto-DNS configurations for <a href=\"https:\/\/domains.squarespace.com\/google-domains\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">Google Domains<\/a> but uses a single TXT record for DKIM.<\/li>\n<li><strong>Microsoft 365<\/strong> requires manual configuration with two CNAME records for DKIM.<\/li>\n<\/ul>\n<h3 id=\"why-it-matters\" tabindex=\"-1\">Why It Matters:<\/h3>\n<ul>\n<li>Phishing attacks surged <strong>1,270% in 2024<\/strong>, with <strong>91% of cyberattacks<\/strong> starting via email.<\/li>\n<li>Proper email authentication can reduce phishing success by <strong>70%<\/strong> and improve deliverability by 10\u201320%.<\/li>\n<\/ul>\n<p>Below, you&#8217;ll find a detailed guide on setting up SPF, DKIM, and DMARC for both platforms, along with a comparison to help you choose the right solution for your needs.<\/p>\n<h2 id=\"how-to-set-up-spf-dkim-and-dmarc-for-gmail\" tabindex=\"-1\" class=\"sb h2-sbb-cls\"><span class=\"ez-toc-section\" id=\"How_to_Set_Up_SPF_DKIM_and_DMARC_for_Gmail\"><\/span>How to Set Up SPF, DKIM, and DMARC for Gmail<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p> <iframe class=\"sb-iframe\" src=\"https:\/\/www.youtube.com\/embed\/ixLAsfSQOb4\" frameborder=\"0\" loading=\"lazy\" allowfullscreen style=\"width: 100%; height: auto; aspect-ratio: 16\/9;\"><\/iframe><\/p>\n<h2 id=\"setting-up-spf-dkim-and-dmarc-in-google-workspace\" tabindex=\"-1\" class=\"sb h2-sbb-cls\"><span class=\"ez-toc-section\" id=\"Setting_Up_SPF_DKIM_and_DMARC_in_Google_Workspace\"><\/span>Setting Up SPF, DKIM, and DMARC in <a href=\"https:\/\/workspace.google.com\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">Google Workspace<\/a><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><img decoding=\"async\" src=\"https:\/\/assets.seobotai.com\/zapmail.ai\/69437ec612e0ddc125dc2869\/2b2fb20b3e9a13a0813610c2670031b2.jpg\" alt=\"Google Workspace\" style=\"width:100%;\"><\/p>\n<p>Google Workspace makes setting up email authentication straightforward by generating the necessary DNS records for you. All you have to do is copy and paste them into your DNS settings. If you purchased your domain through Google Domains or <a href=\"https:\/\/www.squarespace.com\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">Squarespace<\/a>, Google Workspace automatically adds the DKIM key to your DNS settings.<\/p>\n<p>Keep in mind that DNS changes can take anywhere from a few minutes to up to 48 hours to fully propagate.<\/p>\n<h3 id=\"spf-setup-in-google-workspace\" tabindex=\"-1\">SPF Setup in Google Workspace<\/h3>\n<p>SPF, or Sender Policy Framework, is used to specify which IP addresses are authorized to send emails on behalf of your domain. To set it up, log in to your DNS provider&#8217;s management portal and add the following TXT record:<\/p>\n<ul>\n<li><strong>Name\/Host:<\/strong> <code>@<\/code><\/li>\n<li><strong>Type:<\/strong> TXT<\/li>\n<li><strong>Value:<\/strong> <code>v=spf1 include:_spf.google.com ~all<\/code><\/li>\n<\/ul>\n<p>The <code>~all<\/code> at the end indicates a &quot;soft fail.&quot; This means emails that don&#8217;t pass the SPF check will still be accepted but flagged as suspicious &#8211; ideal during the initial setup phase.<\/p>\n<p>If you&#8217;re using multiple email services (e.g., Google Workspace and a marketing platform like <a href=\"https:\/\/www.mailgun.com\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">Mailgun<\/a>), you&#8217;ll need to combine them into a single SPF record. For example:<\/p>\n<p><code>v=spf1 include:_spf.google.com include:mailgun.org ~all<\/code><\/p>\n<p>It&#8217;s crucial to consolidate all email services into one SPF record because each <code>include:<\/code> statement triggers a DNS lookup. DNS lookups are capped at 10, so exceeding this limit can cause issues. To stay within the limit, consider &quot;flattening&quot; the record by replacing some <code>include:<\/code> entries with their corresponding IP addresses using the <code>ip4:<\/code> mechanism.<\/p>\n<p>After saving the record, verify your setup using an SPF checker tool or the <a href=\"https:\/\/toolbox.googleapps.com\/apps\/main\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">Google Admin Toolbox<\/a>.<\/p>\n<h3 id=\"dkim-setup-in-google-workspace\" tabindex=\"-1\">DKIM Setup in Google Workspace<\/h3>\n<p>DKIM, or DomainKeys Identified Mail, ensures your emails remain unaltered during transit by adding a digital signature. You can generate your DKIM key in the Google Admin Console by navigating to <strong>Apps &gt; Google Workspace &gt; Gmail &gt; Authenticate Email<\/strong>. Once generated, you&#8217;ll need to add the provided TXT record to your DNS settings.<\/p>\n<p>Google recommends using a 2048-bit RSA key for stronger security. However, if your DNS provider doesn&#8217;t support long TXT strings, you can opt for a 1024-bit key instead. The TXT record typically looks like this:<\/p>\n<ul>\n<li><strong>Name\/Host:<\/strong> <code>google._domainkey<\/code><\/li>\n<li><strong>Type:<\/strong> TXT<\/li>\n<li><strong>Value:<\/strong> <code>v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA\u2026<\/code><\/li>\n<\/ul>\n<p>Add this record to your DNS settings. Some DNS providers automatically append your domain name to TXT records, so double-check to ensure the configuration is correct. Afterward, go back to the Google Admin Console and click <strong>Start Authentication<\/strong> to verify the setup.<\/p>\n<p>For better security, make it a habit to rotate your DKIM keys annually.<\/p>\n<p>Once SPF and DKIM are in place, you\u2019re ready to configure DMARC or use <a href=\"https:\/\/zapmail.ai\/blog\/email-deliverability-with-automated-dkim-spf-and-dmarc-setup\/\" style=\"display: inline;\">automated DKIM, SPF, and DMARC setup<\/a> to streamline the process.<\/p>\n<h3 id=\"dmarc-setup-in-google-workspace\" tabindex=\"-1\">DMARC Setup in Google Workspace<\/h3>\n<p>DMARC, or Domain-based Message Authentication, Reporting, and Conformance, tells receiving email servers how to handle emails that fail SPF or DKIM checks. It also requires both SPF and DKIM to be properly set up beforehand.<\/p>\n<p>To configure DMARC, add another TXT record to your DNS:<\/p>\n<ul>\n<li><strong>Name\/Host:<\/strong> <code>_dmarc<\/code><\/li>\n<li><strong>Type:<\/strong> TXT<\/li>\n<li><strong>Value:<\/strong> <code>v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com<\/code><\/li>\n<\/ul>\n<p>Starting with a <code>p=none<\/code> policy allows you to monitor authentication failures without impacting email delivery. Set up a dedicated email address, such as <code>dmarc-reports@yourdomain.com<\/code>, to receive these reports and review them regularly.<\/p>\n<p>Once you&#8217;re confident everything is functioning as expected, you can tighten the policy. Switch to <code>p=quarantine<\/code> to send failing emails to the spam folder, and eventually to <code>p=reject<\/code> to block them entirely. During testing, adding <code>pct=100<\/code> to your DMARC record ensures the policy applies to all emails, making it easier to troubleshoot.<\/p>\n<p>Properly configured DMARC can <a href=\"https:\/\/zapmail.ai\/blog\/improve-email-deliverability\/\" style=\"display: inline;\">improve email deliverability<\/a> rates by 10\u201320%. This highlights the <a href=\"https:\/\/zapmail.ai\/blog\/role-of-google-mailboxes-in-improving-email-deliverability-rate\/\" style=\"display: inline;\">role of Google mailboxes<\/a> in maintaining high sender reputation. Moreover, as of early 2024, both Google and Yahoo require DMARC for bulk email senders.<\/p>\n<h2 id=\"setting-up-spf-dkim-and-dmarc-in-microsoft-365\" tabindex=\"-1\" class=\"sb h2-sbb-cls\"><span class=\"ez-toc-section\" id=\"Setting_Up_SPF_DKIM_and_DMARC_in_Microsoft_365\"><\/span>Setting Up SPF, DKIM, and DMARC in <a href=\"https:\/\/www.office.com\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">Microsoft 365<\/a><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Unlike Google Workspace, Microsoft 365 automatically signs emails sent from its default onmicrosoft.com domain. However, if you&#8217;re using a custom domain, you&#8217;ll need to configure these settings manually. To do this, you&#8217;ll rely on the <a href=\"https:\/\/learn.microsoft.com\/en-us\/defender-xdr\/microsoft-365-defender-portal\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">Microsoft 365 Defender<\/a> portal and your DNS provider. Keep in mind that changes to DNS records can take some time to propagate.<\/p>\n<h3 id=\"spf-setup-in-microsoft-365\" tabindex=\"-1\">SPF Setup in Microsoft 365<\/h3>\n<p>To set up SPF for Microsoft 365, add the following TXT record to your DNS settings:<\/p>\n<ul>\n<li><strong>Name\/Host:<\/strong> @<\/li>\n<li><strong>Type:<\/strong> TXT<\/li>\n<li><strong>Value:<\/strong> <code>v=spf1 include:spf.protection.outlook.com ~all<\/code><\/li>\n<\/ul>\n<p>Including <code>spf.protection.outlook.com<\/code> is essential for Microsoft 365 to authenticate outgoing emails properly. If you\u2019re using additional email services, like <a href=\"https:\/\/www.salesforce.com\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">Salesforce<\/a> or marketing platforms, you\u2019ll need to combine their SPF mechanisms into a single record. For example:<br \/> <code>v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com ~all<\/code>.<\/p>\n<p>Remember, each &quot;include:&quot; in an SPF record counts as a DNS lookup, and there\u2019s a limit of 10 lookups. Exceeding this limit can cause SPF authentication to fail. Also, don&#8217;t overwrite existing SPF records &#8211; always append the Microsoft 365 directive to your current record.<\/p>\n<h3 id=\"dkim-setup-in-microsoft-365\" tabindex=\"-1\">DKIM Setup in Microsoft 365<\/h3>\n<p>Setting up DKIM requires both the Microsoft 365 Defender portal and your DNS provider. Start by accessing the Defender portal at <a href=\"https:\/\/security.microsoft.com\/authentication\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">https:\/\/security.microsoft.com\/authentication<\/a> and navigating to the DKIM tab. Select your custom domain, enable DKIM signing, and the portal will generate two CNAME records (commonly named <code>selector1<\/code> and <code>selector2<\/code>) with values tailored for your domain.<\/p>\n<p>Add these CNAME records to your DNS:<\/p>\n<ul>\n<li><strong>Name\/Host:<\/strong> <code>selector1._domainkey<\/code><\/li>\n<li><strong>Type:<\/strong> CNAME<\/li>\n<li><strong>Value:<\/strong> <code>selector1-yourdomain-com._domainkey.tenantdomain.onmicrosoft.com<\/code><\/li>\n<\/ul>\n<p>If you&#8217;re using Cloudflare, ensure that the proxy status for these records is set to &quot;DNS only&quot; (proxy OFF) so Microsoft can detect them properly.<\/p>\n<p>Once the DNS changes propagate, return to the Defender portal to finalize DKIM signing. Microsoft 365 uses 2048-bit RSA keys by default, offering stronger security than the older 1024-bit keys.<\/p>\n<blockquote>\n<p>&quot;The main factor that determines when a custom domain starts DKIM signing outbound mail is the CNAME record detection in DNS.&quot; \u2013 Microsoft Learn<\/p>\n<\/blockquote>\n<p>For organizations managing multiple domains, you can automate DKIM configurations using <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/exchange\/?view=exchange-ps\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" style=\"display: inline;\">Exchange Online PowerShell<\/a> commands like <code>Get-DkimSigningConfig<\/code> and <code>Set-DkimSigningConfig<\/code>.<\/p>\n<p>With SPF and DKIM in place, you\u2019re ready to configure DMARC to complete your email authentication setup.<\/p>\n<h3 id=\"dmarc-setup-in-microsoft-365\" tabindex=\"-1\">DMARC Setup in Microsoft 365<\/h3>\n<p>DMARC is entirely configured through your DNS provider. Add a new TXT record with these details:<\/p>\n<ul>\n<li><strong>Name\/Host:<\/strong> <code>_dmarc<\/code><\/li>\n<li><strong>Type:<\/strong> TXT<\/li>\n<li><strong>Value:<\/strong> <code>v=DMARC1; p=none; rua=mailto:dmarc_reports@yourdomain.com;<\/code><\/li>\n<\/ul>\n<p>Start with a &quot;p=none&quot; policy to monitor email activity without affecting delivery. This allows you to gather data and identify any issues before enforcing stricter policies. Make sure to set up a dedicated email address to receive aggregate DMARC reports and review them regularly.<\/p>\n<p>Microsoft will begin enforcing DMARC on May 5, 2025, for domains sending over 5,000 messages daily to consumer addresses like Outlook.com and Hotmail. At a minimum, domains must have a &quot;p=none&quot; policy with either SPF or DKIM alignment.<\/p>\n<blockquote>\n<p>&quot;One of the most common pitfalls in DMARC implementation is rushing to a &#8216;reject&#8217; policy (p=reject) too quickly. The recommended approach is a gradual enforcement policy, starting with p=none, then moving to p=quarantine, and finally to p=reject as you gain confidence in your configuration.&quot; \u2013 CurlyBinaries<\/p>\n<\/blockquote>\n<p>After monitoring DMARC reports for several weeks, you can gradually strengthen your policy to &quot;p=quarantine&quot; and eventually &quot;p=reject.&quot; This step-by-step process minimizes the risk of legitimate emails being blocked due to configuration errors.<\/p>\n<p>It\u2019s worth noting that Microsoft 365 doesn\u2019t provide built-in dashboards for DMARC analytics, so you may need third-party tools for detailed reporting and insights.<\/p>\n<h6 id=\"sbb-itb-36f7bf9\" tabindex=\"-1\" style=\"display: none;color:transparent;\">sbb-itb-36f7bf9<\/h6>\n<h2 id=\"google-workspace-vs-microsoft-365-setup-comparison\" tabindex=\"-1\" class=\"sb h2-sbb-cls\"><span class=\"ez-toc-section\" id=\"Google_Workspace_vs_Microsoft_365_Setup_Comparison\"><\/span>Google Workspace vs Microsoft 365: Setup Comparison<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<figure>         <img decoding=\"async\" src=\"https:\/\/assets.seobotai.com\/undefined\/69437ec612e0ddc125dc2869-1766032214652.jpg\" alt=\"Google Workspace vs Microsoft 365 Email Authentication Setup Comparison\" style=\"width:100%;\"><figcaption style=\"font-size: 0.85em; text-align: center; margin: 8px; padding: 0;\">\n<p style=\"margin: 0; padding: 4px;\">Google Workspace vs Microsoft 365 Email Authentication Setup Comparison<\/p>\n<\/figcaption><\/figure>\n<p>When it comes to setting up email authentication, both Google Workspace and Microsoft 365 require manual DNS record creation for SPF, DKIM, and DMARC. However, the steps differ slightly between the two. Google Workspace uses a single TXT record for DKIM, while Microsoft 365 requires two CNAME records (selector1 and selector2). Each platform provides setup guidance through their respective admin portals &#8211; Google Admin Console for Workspace and Microsoft 365 Defender portal for Microsoft 365.<\/p>\n<p>Google Workspace does have one convenience: if your domain is hosted with Google Domains or Squarespace, the <a href=\"https:\/\/zapmail.ai\/blog\/spf-dmarc-and-dkim-setup-for-google-domains-and-google-workspace\/\" style=\"display: inline;\">SPF, DMARC, and DKIM setup is automatically generated<\/a> and added to your DNS settings without manual intervention.<\/p>\n<p>A notable example of these differences in action occurred in November 2025. Partha Srinivasan, frustrated with ongoing email deliverability and DMARC issues, migrated from Google Workspace to Microsoft 365. He explained, &quot;Repeated email deliverability issues, constant DMARC headaches, and Google&#8217;s increasing restrictions&quot; were the driving factors behind his decision. After manually updating all DNS records for Microsoft 365, he shared that &quot;Email is more stable now. No more weird bounces or deliverability issues&quot; and praised the &quot;cleaner&quot; DNS management.<\/p>\n<h3 id=\"comparison-table\" tabindex=\"-1\">Comparison Table<\/h3>\n<table style=\"width:100%;\">\n<thead>\n<tr>\n<th>Feature<\/th>\n<th>Google Workspace<\/th>\n<th>Microsoft 365<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Admin Portal<\/strong><\/td>\n<td>Google Admin Console<\/td>\n<td>Microsoft 365 Defender Portal<\/td>\n<\/tr>\n<tr>\n<td><strong>SPF Record Format<\/strong><\/td>\n<td>Single TXT record: <code>v=spf1 include:_spf.google.com ~all<\/code><\/td>\n<td>Single TXT record: <code>v=spf1 include:spf.protection.outlook.com ~all<\/code><\/td>\n<\/tr>\n<tr>\n<td><strong>DKIM Records<\/strong><\/td>\n<td>1 TXT record (e.g., <code>google._domainkey<\/code>)<\/td>\n<td>2 CNAME records (<code>selector1<\/code>, <code>selector2<\/code>)<\/td>\n<\/tr>\n<tr>\n<td><strong>DKIM Key Length<\/strong><\/td>\n<td>2048-bit (recommended)<\/td>\n<td>2048-bit (default)<\/td>\n<\/tr>\n<tr>\n<td><strong>DKIM Propagation Time<\/strong><\/td>\n<td>24\u201372 hours after Gmail activation<\/td>\n<td>Immediate after domain verification<\/td>\n<\/tr>\n<tr>\n<td><strong>DMARC Setup<\/strong><\/td>\n<td>Manual TXT record at DNS provider<\/td>\n<td>Manual TXT record at DNS provider<\/td>\n<\/tr>\n<tr>\n<td><strong>Built-in DMARC Reporting<\/strong><\/td>\n<td>No native dashboard<\/td>\n<td>No native dashboard<\/td>\n<\/tr>\n<tr>\n<td><strong>DNS Propagation Time<\/strong><\/td>\n<td>Up to 48 hours<\/td>\n<td>Up to 48 hours<\/td>\n<\/tr>\n<tr>\n<td><strong>Automated Setup (Own Domains)<\/strong><\/td>\n<td>Yes, for Google Domains\/Squarespace only<\/td>\n<td>No<\/td>\n<\/tr>\n<tr>\n<td><strong>DNS Settings Access<\/strong><\/td>\n<td>Limited<\/td>\n<td>Full<\/td>\n<\/tr>\n<tr>\n<td><strong>Setup Complexity<\/strong><\/td>\n<td>Simple for new domains<\/td>\n<td>Requires more manual configuration<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>For organizations managing multiple domains, automated DNS configuration tools can significantly cut setup time. What might normally take over 24 hours can be reduced to just 30 minutes with these solutions. This comparison underscores the key setup differences and provides insights for optimizing DNS configuration to improve <a href=\"https:\/\/zapmail.ai\/blog\/what-is-email-deliverability-a-simple-guide-2024\/\" style=\"display: inline;\">email deliverability<\/a>.<\/p>\n<h2 id=\"best-practices-and-recommendations\" tabindex=\"-1\" class=\"sb h2-sbb-cls\"><span class=\"ez-toc-section\" id=\"Best_Practices_and_Recommendations\"><\/span>Best Practices and Recommendations<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"automated-dns-configuration-solutions\" tabindex=\"-1\">Automated DNS Configuration Solutions<\/h3>\n<p>Configuring DNS settings like SPF, DKIM, and DMARC manually can be a time-consuming task, especially when managing multiple domains. Automated solutions can significantly cut down on setup time and reduce errors.<\/p>\n<p>Take <strong>Zapmail<\/strong>, for instance. It automates DNS configurations for both Google Workspace and Microsoft 365 mailboxes. Plus, it offers pre-warmed mailboxes, making them ready for outreach right out of the gate. The platform also includes AI-powered tools to help you create professional and <a href=\"https:\/\/zapmail.ai\/blog\/custom-domain-in-cold-email-boost-your-outreach\/\" style=\"display: inline;\">consistent domain and mailbox names<\/a> across your setup.<\/p>\n<p>One standout feature is <strong>domain isolation<\/strong>, which keeps each client or campaign on its own domain. This way, if one domain faces deliverability issues, others remain unaffected. Zapmail also provides an all-in-one interface for managing SPF, DKIM, and DMARC records. On top of that, it integrates seamlessly with over 50 <a href=\"https:\/\/zapmail.ai\/blog\/cold-email-outreach-tools\/\" style=\"display: inline;\">outreach platforms<\/a>, letting you connect authenticated mailboxes directly to your existing workflow. This level of automation ensures your email deliverability practices are solid from the start.<\/p>\n<h3 id=\"deliverability-best-practices\" tabindex=\"-1\">Deliverability Best Practices<\/h3>\n<p>Automation is just the beginning. To truly optimize email deliverability, you need to adopt a few additional practices to ensure your emails consistently land in inboxes.<\/p>\n<ul>\n<li> <strong>Use pre-warmed mailboxes<\/strong>: Freshly created accounts are more likely to be flagged as spam. Pre-warmed mailboxes with established sending patterns perform better and reduce the risk of triggering spam filters. <\/li>\n<li> <strong>Gradually tighten your DMARC policy<\/strong>: Once SPF and DKIM are verified, adjust your DMARC policy step by step. This helps block unauthorized senders from using your domain without disrupting legitimate email traffic. <\/li>\n<li> <strong>Monitor authentication reports regularly<\/strong>: During the initial setup, review reports weekly, then shift to monthly monitoring. Tools like <strong>Cloudflare&#8217;s DMARC management<\/strong> simplify this process by providing user-friendly dashboards to spot configuration errors or spoofing attempts quickly. <\/li>\n<li> <strong>Keep SPF records concise<\/strong>: Avoid exceeding the 255-character limit for SPF records, as it can lead to validation errors. If you need to accommodate multiple email services, use the &quot;include&quot; mechanism instead of listing individual IP addresses. This keeps your records easier to manage and update. <\/li>\n<\/ul>\n<h2 id=\"conclusion\" tabindex=\"-1\" class=\"sb h2-sbb-cls\"><span class=\"ez-toc-section\" id=\"Conclusion\"><\/span>Conclusion<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Both Google Workspace and Microsoft 365 require <a href=\"https:\/\/zapmail.ai\/blog\/what-is-dkim-spf-dmarc-and-how-dkim-spf-dmarc-work\/\" style=\"display: inline;\">SPF, DKIM, and DMARC<\/a> for email authentication, but the technical details differ. Google Workspace uses <strong>_spf.google.com<\/strong> for SPF records and allows you to generate DKIM keys directly in its Admin Console. On the other hand, Microsoft 365 relies on <strong>spf.protection.outlook.com<\/strong> and requires CNAME records to configure DKIM.<\/p>\n<p>While the setup process for these protocols might seem straightforward, managing configurations across multiple domains can quickly become a complex and error-prone task &#8211; especially for large-scale email campaigns.<\/p>\n<p>This is where automation tools like <strong>Zapmail<\/strong> step in to simplify the process. These tools handle DNS configurations automatically, offer pre-warmed mailboxes with domain isolation, and integrate seamlessly with over 50 outreach platforms.<\/p>\n<p>For businesses juggling multiple clients or campaigns, automation isn&#8217;t just helpful &#8211; it\u2019s necessary. While manual DNS management might work for a single domain, it becomes unsustainable when scaling operations. Tools like Zapmail ensure consistent deliverability and make scaling both efficient and hassle-free.<\/p>\n<h2 id=\"faqs\" tabindex=\"-1\" class=\"sb h2-sbb-cls\"><span class=\"ez-toc-section\" id=\"FAQs\"><\/span>FAQs<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"how-does-setting-up-spf-dkim-and-dmarc-differ-between-google-workspace-and-microsoft-365\" tabindex=\"-1\" data-faq-q>How does setting up SPF, DKIM, and DMARC differ between Google Workspace and Microsoft 365?<\/h3>\n<p>Both Google Workspace and Microsoft 365 require configuring <strong>SPF<\/strong>, <strong>DKIM<\/strong>, and <strong>DMARC<\/strong> through DNS records. However, the setup process varies in complexity and the tools provided by each platform.<\/p>\n<p><strong>SPF<\/strong>: Google Workspace uses a straightforward SPF record: <code>v=spf1 include:_spf.google.com ~all<\/code>. In contrast, Microsoft 365 typically employs a more intricate SPF record: <code>v=spf1 include:spf.protection.outlook.com -all<\/code>. Depending on your use of additional Microsoft services, you might need to include extra entries, making the setup a bit more involved.<\/p>\n<p><strong>DKIM<\/strong>: For Google Workspace, the process is relatively simple. You generate a DKIM key directly in the Admin console, publish a single CNAME record, and enable signing. Microsoft 365, on the other hand, requires two CNAME records (selector 1 and selector 2) to be added. Activating DKIM involves using either the Defender portal or PowerShell, adding an extra layer of complexity.<\/p>\n<p><strong>DMARC<\/strong>: While the DMARC record format is the same for both platforms, the monitoring and management tools differ. Google Workspace simplifies this process by integrating monitoring capabilities into its Admin console. In Microsoft 365, you\u2019ll need to rely on the security and compliance center to view reports and make adjustments.<\/p>\n<p>In summary, Google Workspace tends to offer a more straightforward setup process, while Microsoft 365 may demand additional steps and configurations.<\/p>\n<h3 id=\"how-do-automated-dns-tools-simplify-managing-spf-dkim-and-dmarc-for-multiple-domains\" tabindex=\"-1\" data-faq-q>How do automated DNS tools simplify managing SPF, DKIM, and DMARC for multiple domains?<\/h3>\n<p>Automated DNS tools make setting up and managing SPF, DKIM, and DMARC records much easier by taking the guesswork and manual effort out of the process. Instead of hopping between domain registrars to manually create TXT, CNAME, or NS records, these tools handle it for you. They generate the correct syntax for each domain and even allow bulk updates, ensuring that record formats, TTL values, and naming conventions stay consistent. This drastically reduces the chances of making configuration mistakes.<\/p>\n<p>These tools also let teams manage multiple domains from one central dashboard. Adding new domains, rotating keys, or updating policies becomes a matter of just a few clicks. Plus, they can verify DNS changes and flag potential issues, making ongoing monitoring a breeze. For example, Zapmail takes this a step further by providing pre-warmed Google and Microsoft mailboxes with fully automated DNS configuration. This means users can focus on running high-deliverability email campaigns without getting bogged down in complicated DNS setups.<\/p>\n<h3 id=\"why-should-you-gradually-strengthen-your-dmarc-policy-after-setting-it-up\" tabindex=\"-1\" data-faq-q>Why should you gradually strengthen your DMARC policy after setting it up?<\/h3>\n<p>Starting with a <strong>DMARC policy of p=none<\/strong> is a smart way to keep an eye on how your domain is being used without disrupting email delivery. It lets you gather useful data on both legitimate emails and suspicious activity tied to your domain.<\/p>\n<p>By spotting and fixing authentication problems early on, you can make sure legitimate emails reach their destination without being mistakenly blocked. Once you\u2019ve ironed out any issues and everything is running smoothly, you can confidently shift to stricter policies like <strong>quarantine<\/strong> or <strong>reject<\/strong> to shield your domain from misuse.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Related_Blog_Posts\"><\/span>Related Blog Posts<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"\/blog\/spf-dkim-dmarc-validator\" style=\"display: inline;\">SPF DKIM DMARC Validator<\/a><\/li>\n<li><a href=\"\/blog\/ultimate-guide-masked-domains-cold-email\" style=\"display: inline;\">Ultimate Guide to Masked Domains for Cold Email<\/a><\/li>\n<li><a href=\"\/blog\/how-email-volume-affects-deliverability\" style=\"display: inline;\">How Email Volume Affects Deliverability<\/a><\/li>\n<li><a href=\"\/blog\/warm-up-tools-inbox-placement-tracking\" style=\"display: inline;\">Top 7 Warm-Up Tools with Inbox Placement Tracking<\/a><\/li>\n<\/ul>\n<p><script async type=\"text\/javascript\" src=\"https:\/\/app.seobotai.com\/banner\/banner.js?id=69437ec612e0ddc125dc2869\"><\/script><\/p>\n","protected":false},"excerpt":{"rendered":"Proper SPF, DKIM, and DMARC setup prevents spoofing and improves deliverability with step-by-step setup, platform comparison, and automation tips.","protected":false},"author":1,"featured_media":3496,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_display_header_overlay":false,"csco_singular_sidebar":"","csco_page_header_type":"","footnotes":""},"categories":[154],"tags":[],"class_list":{"0":"post-3497","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-guide","8":"cs-entry"},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Google Workspace vs Microsoft 365: SPF, DKIM, DMARC Setup %<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Google Workspace vs Microsoft 365: SPF, DKIM, DMARC Setup %\" \/>\n<meta property=\"og:description\" content=\"Proper SPF, DKIM, and DMARC setup prevents spoofing and improves deliverability with step-by-step setup, platform comparison, and automation tips.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/\" \/>\n<meta property=\"og:site_name\" content=\"Affordable Google Workspace Solutions with Zapmail\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-18T04:39:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/assets.seobotai.com\/zapmail.ai\/69437ec612e0ddc125dc2869\/2b2fb20b3e9a13a0813610c2670031b2.jpg\" \/>\n<meta name=\"author\" content=\"Zapmail\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Zapmail\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"14 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/\",\"url\":\"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/\",\"name\":\"Google Workspace vs Microsoft 365: SPF, DKIM, DMARC Setup %\",\"isPartOf\":{\"@id\":\"https:\/\/zapmail.ai\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/zapmail.ai\/wp-content\/uploads\/2025\/12\/image_b8ac03277dfbdb346e38680f0d3b28b4.jpeg\",\"datePublished\":\"2025-12-18T04:39:13+00:00\",\"dateModified\":\"2025-12-18T04:39:13+00:00\",\"author\":{\"@id\":\"https:\/\/zapmail.ai\/blog\/#\/schema\/person\/0af5551ac37733d837617c3f13f49142\"},\"breadcrumb\":{\"@id\":\"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/#primaryimage\",\"url\":\"https:\/\/zapmail.ai\/wp-content\/uploads\/2025\/12\/image_b8ac03277dfbdb346e38680f0d3b28b4.jpeg\",\"contentUrl\":\"https:\/\/zapmail.ai\/wp-content\/uploads\/2025\/12\/image_b8ac03277dfbdb346e38680f0d3b28b4.jpeg\",\"width\":1536,\"height\":1024,\"caption\":\"Google Workspace vs Microsoft 365: SPF, DKIM, DMARC Setup\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/zapmail.ai\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Uncategorized\",\"item\":\"https:\/\/zapmail.ai\/blog\/category\/uncategorized\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Google Workspace vs Microsoft 365: SPF, DKIM, DMARC Setup\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/zapmail.ai\/blog\/#website\",\"url\":\"https:\/\/zapmail.ai\/blog\/\",\"name\":\"Affordable Google Workspace Solutions with Zapmail\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/zapmail.ai\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/zapmail.ai\/blog\/#\/schema\/person\/0af5551ac37733d837617c3f13f49142\",\"name\":\"Zapmail\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/zapmail.ai\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0588aa3de565b0d2fc82357754132b3aecaeae352a7e1bd280be019d3c689ad6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0588aa3de565b0d2fc82357754132b3aecaeae352a7e1bd280be019d3c689ad6?s=96&d=mm&r=g\",\"caption\":\"Zapmail\"},\"sameAs\":[\"https:\/\/zapmail.ai\"],\"url\":\"https:\/\/zapmail.ai\/blog\/author\/zapmail-wp\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Google Workspace vs Microsoft 365: SPF, DKIM, DMARC Setup %","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/","og_locale":"en_US","og_type":"article","og_title":"Google Workspace vs Microsoft 365: SPF, DKIM, DMARC Setup %","og_description":"Proper SPF, DKIM, and DMARC setup prevents spoofing and improves deliverability with step-by-step setup, platform comparison, and automation tips.","og_url":"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/","og_site_name":"Affordable Google Workspace Solutions with Zapmail","article_published_time":"2025-12-18T04:39:13+00:00","og_image":[{"url":"https:\/\/assets.seobotai.com\/zapmail.ai\/69437ec612e0ddc125dc2869\/2b2fb20b3e9a13a0813610c2670031b2.jpg"}],"author":"Zapmail","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Zapmail","Est. reading time":"14 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/","url":"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/","name":"Google Workspace vs Microsoft 365: SPF, DKIM, DMARC Setup %","isPartOf":{"@id":"https:\/\/zapmail.ai\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/#primaryimage"},"image":{"@id":"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/#primaryimage"},"thumbnailUrl":"https:\/\/zapmail.ai\/wp-content\/uploads\/2025\/12\/image_b8ac03277dfbdb346e38680f0d3b28b4.jpeg","datePublished":"2025-12-18T04:39:13+00:00","dateModified":"2025-12-18T04:39:13+00:00","author":{"@id":"https:\/\/zapmail.ai\/blog\/#\/schema\/person\/0af5551ac37733d837617c3f13f49142"},"breadcrumb":{"@id":"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/#primaryimage","url":"https:\/\/zapmail.ai\/wp-content\/uploads\/2025\/12\/image_b8ac03277dfbdb346e38680f0d3b28b4.jpeg","contentUrl":"https:\/\/zapmail.ai\/wp-content\/uploads\/2025\/12\/image_b8ac03277dfbdb346e38680f0d3b28b4.jpeg","width":1536,"height":1024,"caption":"Google Workspace vs Microsoft 365: SPF, DKIM, DMARC Setup"},{"@type":"BreadcrumbList","@id":"https:\/\/zapmail.ai\/blog\/google-workspace-vs-microsoft-365-spf-dkim-dmarc-setup\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zapmail.ai\/blog\/"},{"@type":"ListItem","position":2,"name":"Uncategorized","item":"https:\/\/zapmail.ai\/blog\/category\/uncategorized\/"},{"@type":"ListItem","position":3,"name":"Google Workspace vs Microsoft 365: SPF, DKIM, DMARC Setup"}]},{"@type":"WebSite","@id":"https:\/\/zapmail.ai\/blog\/#website","url":"https:\/\/zapmail.ai\/blog\/","name":"Affordable Google Workspace Solutions with Zapmail","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zapmail.ai\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/zapmail.ai\/blog\/#\/schema\/person\/0af5551ac37733d837617c3f13f49142","name":"Zapmail","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zapmail.ai\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0588aa3de565b0d2fc82357754132b3aecaeae352a7e1bd280be019d3c689ad6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0588aa3de565b0d2fc82357754132b3aecaeae352a7e1bd280be019d3c689ad6?s=96&d=mm&r=g","caption":"Zapmail"},"sameAs":["https:\/\/zapmail.ai"],"url":"https:\/\/zapmail.ai\/blog\/author\/zapmail-wp\/"}]}},"_links":{"self":[{"href":"https:\/\/zapmail.ai\/blog\/wp-json\/wp\/v2\/posts\/3497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zapmail.ai\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zapmail.ai\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zapmail.ai\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zapmail.ai\/blog\/wp-json\/wp\/v2\/comments?post=3497"}],"version-history":[{"count":0,"href":"https:\/\/zapmail.ai\/blog\/wp-json\/wp\/v2\/posts\/3497\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zapmail.ai\/blog\/wp-json\/wp\/v2\/media\/3496"}],"wp:attachment":[{"href":"https:\/\/zapmail.ai\/blog\/wp-json\/wp\/v2\/media?parent=3497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zapmail.ai\/blog\/wp-json\/wp\/v2\/categories?post=3497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zapmail.ai\/blog\/wp-json\/wp\/v2\/tags?post=3497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}