Namecheap + Google Workspace: SPF, DKIM and DMARC setup that actually passes

If your Google Workspace mail is landing in spam, or someone is sending invoices as your domain, the cause is almost always the same three records — published wrongly, published twice, or never published at all. This guide fixes that for a domain whose DNS lives at Namecheap.

What each record actually does

Three records, three different jobs. People routinely publish one and assume they are covered.

Since 2024 Gmail and Microsoft both expect all three from anyone sending in volume. A missing DMARC record on its own is now enough to affect where your mail lands.

Step 1 — Lower the TTL first

Do this before any other change and it will save you an afternoon. In Namecheap: Domain List → Manage → Advanced DNS. For each existing mail-related record, set the TTL to 5 min (or the lowest available).

TTL is how long resolvers cache a record. At the default of 30 minutes to an hour, a typo takes that long to correct everywhere. At 5 minutes, a mistake is reversible almost immediately. Put the TTLs back to automatic once everything passes.

Step 2 — Audit what is already there

In Advanced DNS, look at every record with type TXT Record. Write down anything that starts with v=spf1.

• Zero SPF records — straightforward, you will add one in step 3.
• Exactly one — you will edit it rather than adding another.
• Two or more — this is already broken, and it is the most common state we find. Fix it in step 3 by merging.

Also note whether an old host's include is present, such as include:secureserver.net or include:spf.hostinger.com. Whether you keep it depends on one question: does that server still send mail for you? A website contact form or WooCommerce order notification counts. If nothing sends from there any more, drop it.

Step 3 — Publish exactly one SPF record

In Advanced DNS, Add New Record → TXT Record:

Two details that trip people up. The Host field takes @, not your domain name — Namecheap appends the domain for you, so typing yourdomain.com creates a record at yourdomain.com.yourdomain.com. And do not wrap the value in quotation marks; Namecheap adds those itself.

If you also send from your website or another service

Merge, never duplicate. One record, one v=spf1 at the start, one ~all at the end, every include in between:

v=spf1 include:_spf.google.com include:spf.hostinger.com ~all

Keep the total number of DNS-resolving mechanisms — every include:, a:, mx: and redirect= — at ten or fewer. Above ten, SPF returns a permanent error and fails as if it were absent.

Why ~all rather than -all? Softfail marks unlisted senders as suspicious; hardfail rejects them outright. Start with ~all, and tighten to -all once DMARC reports confirm nothing legitimate is being missed. Never use +all — it authorises the entire internet to send as you.

Step 4 — Generate the DKIM key in Google

This half happens in Google, not Namecheap. In the Google Admin console (admin.google.com), go to Apps → Google Workspace → Gmail → Authenticate email.

1. Select your domain from the dropdown.
2. Click Generate new record.
3. Choose 2048-bit key length. If Google says your DNS provider does not support long keys, ignore it — Namecheap does.
4. Leave the prefix selector as google unless you have a reason to change it.
5. Copy the resulting TXT record value. It is long; take all of it.

Leave that tab open. You come back to it in step 5, and forgetting to is the second most common failure.

Add the DKIM record in Namecheap

Host is google._domainkey — not the full google._domainkey.yourdomain.com, for the same reason as before. If the value is rejected as too long, remove any line breaks your clipboard introduced; it must be one continuous string.

Step 5 — Switch signing on (the step everyone forgets)

Publishing the key does nothing by itself. Wait five to ten minutes, return to the Google tab, and click Start authentication. Until that button is clicked, your mail is unsigned no matter how correct the DNS record is.

If Google reports it cannot find the record, wait another ten minutes rather than re-generating the key. Re-generating invalidates what you just published and restarts the whole step.

Step 6 — Publish DMARC in monitoring mode

Back in Namecheap, one more TXT record:

Start at p=none. It enforces nothing, but it starts the aggregate reports arriving at the rua address, and those reports are how you find the sender you forgot about — the invoicing tool, the CRM, the old newsletter platform.

Resist going straight to p=reject. On a domain with a forgotten sender, reject means those messages disappear silently, and the first you hear of it is a client asking why they never got your quote.

Step 7 — Verify, then tighten

Wait fifteen minutes, then check all three. From a terminal:

dig yourdomain.com TXT +short
dig google._domainkey.yourdomain.com TXT +short
dig _dmarc.yourdomain.com TXT +short

Or run the domain through our record checker, which flags duplicates and weak policies for you. For an end-to-end test, send a message to a Gmail address you own, open it, and use Show original — you want PASS beside SPF, DKIM and DMARC.

The tightening schedule

• Week 1–2: leave p=none and read the reports. Identify every legitimate sender.
• Week 3: add any missing senders to SPF (merged into the one record), then move to p=quarantine.
• Week 5+: if reports stay clean, move to p=reject and change SPF to -all.
• Finally: set the TTLs back to automatic.

When it still does not work

Mail still going to spam with all three passing

Authentication is necessary, not sufficient. Check your domain and sending IP against a blocklist, make sure you are not mailing purchased lists, and give a brand-new domain a few weeks of low-volume sending before expecting good placement.

Google says the DKIM record cannot be found

Nine times out of ten the Host field contains the full domain twice. Open the record in Namecheap and confirm it reads exactly google._domainkey.

SPF was fine, then broke after adding a service

That service told you to “add this SPF record” and you added a second one. Merge them into one.

DMARC reports arrive as unreadable XML

They are meant to — the format is for machines. Paste one into any free DMARC report analyser, or point rua at a reporting service that renders them for you.