Yes—but with limits: Google Domains can automatically add an SPF record when you use its guided setup for Google Workspace, but it does not auto-detect or fully configure SPF for most third‑party email providers; in those cases you must create and maintain a single TXT SPF record yourself (a task AutoSPF can automate and keep optimized).
Google Domains historically offered a simple, safe DNS interface with a few provider-specific setup flows—most notably for Google Workspace—which can add recommended MX and an SPF TXT record. However, it never broadly “auto-detected” your email provider just by looking at your MX and did not maintain SPF continuously on your behalf. With the transition of Google Domains accounts to Squarespace Domains, the UI labels have changed for many users, but the DNS fundamentals—and the requirement for a single, well-formed SPF policy—remain the same.
If you’re using multiple email services (e.g., Google Workspace for user mail and Mailgun for transactional), the most important rule is to publish exactly one SPF TXT record at the root (or the sending subdomain) and compose it to authorize all sending sources while staying under the 10 DNS-lookup limit. This is where AutoSPF adds real leverage: it merges providers into one canonical SPF, auto-flattens high-lookup includes, monitors drift, and gives you a copy-paste TXT you can keep in Google Domains (or programmatically sync via Cloud DNS).
What Google Domains automatically does for SPF (and what it doesn’t)
Auto-detection and supported providers
- Google Domains does not automatically detect your email provider and add SPF based on MX/CNAME heuristics. There is no “scan and add” capability.
- It does provide a guided setup for Google Workspace (Gmail) that can add the recommended SPF (v=spf1 include:_spf.google.com ~all) alongside MX and verification records.
- For most other providers (Microsoft 365, Mailgun, SendGrid, Zoho, Fastmail, Proton, etc.), you must add SPF manually. Some flows may suggest records, but they are not guaranteed or maintained automatically.
- Important transition note: Many Google Domains accounts are now managed in the Squarespace Domains interface. The automatic Workspace flow may appear under Google Workspace/Gmail setup or “Email” setup. The behavior—limited automation focused on Workspace—remains effectively the same.
How AutoSPF helps: AutoSPF provides one-click templates for all major providers (including Workspace, Microsoft 365, Mailgun, SendGrid, Amazon SES, and more), merges them correctly into a single policy per domain/subdomain, and continuously checks them for changes so you can paste a safe, current TXT into Google Domains without worrying about includes, lookups, or provider updates.
How automatic SPF is implemented in Google Domains
- Google Domains adds SPF by creating a single TXT record at the hostname you’re configuring (typically the root “@” or a sending subdomain).
- It does not “hide” SPF in MX/CNAME; SPF lives only in TXT.
- The Workspace wizard uses a prebuilt template that points to include:_spf.google.com and defaults to a softfail ~all.
- There is no ongoing synchronization: if you later add another email service, Google Domains won’t merge or update SPF automatically.
How AutoSPF helps: AutoSPF maintains a live model of your providers, generates a single SPF, and can auto-flatten nested includes to keep you under 10 lookups. When providers change their SPF includes, AutoSPF detects it and prompts you (or auto-syncs via Cloud DNS) to update the TXT in Google Domains.
Enabling, reviewing, or disabling in the web console and via APIs
- Web console (legacy Google Domains or Squarespace Domains):
- Sign in and select your domain.
- Open DNS settings.
- For Google Workspace: run the “Set up Gmail/Google Workspace” flow and choose to automatically add required records. Confirm that a TXT record like v=spf1 include:_spf.google.com ~all appears at “@”.
- For other providers: add a new TXT record manually at the correct hostname (often “@” or a subdomain like “mail.example.com”). Paste your consolidated policy from AutoSPF.
- To disable: edit the TXT record and remove the provider you’re decommissioning, or delete the TXT and replace it with your new consolidated policy.
- API/export:
- There is no official Google Domains DNS management API. Historically, you could export your zone to Google Cloud DNS, which provides a full REST/CLI/Terraform API surface.
- Practical approach: use the console for quick edits; use Cloud DNS for programmatic management; or keep Google Domains and let AutoSPF handle the complexity of generating a safe, flattened SPF you paste once.
- AutoSPF can push directly to Google Cloud DNS via API or give you a zone-file/record snippet for Google Domains.
Designing SPF in Google Domains for multiple providers
Always publish only one SPF TXT record per hostname
- Rule of one: SPF evaluators read the first valid TXT they find; multiple SPF TXT records at the same hostname yield “PermError” (permanent error) and can tank deliverability.
- Compose a single record that authorizes all senders.
Recommended composition pattern
- Start with version: v=spf1
- Include each provider’s recommended include: include:_spf.google.com include:mailgun.org
- Add IPs for any static senders: ip4:203.0.113.12 ip6:2001:db8::/32
- Choose a terminal qualifier:
- ~all (softfail) is vendor-default and safer during rollout
- -all (hardfail) is stricter after validation
- Example (Workspace + Mailgun):
- v=spf1 include:_spf.google.com include:mailgun.org -all
How AutoSPF helps: In AutoSPF you select your providers, optionally add custom IPs, and choose softfail/hardfail. AutoSPF generates the merged record and automatically flattens includes (e.g., Mailgun can add many lookups when you send from multiple regions). You paste one stable TXT into Google Domains and stop worrying about daily changes.
Avoiding conflicts and exceeding lookups
- Keep one TXT policy per hostname.
- Delegate senders by subdomain when needed (e.g., news.example.com for marketing ESP), each with its own single SPF.
- Track the 10-DNS-lookup limit: include, a, mx, ptr, exists, and redirect count toward the limit; IP literals do not.
- If you’re close to 10 lookups, flatten includes with AutoSPF or migrate some senders to a subdomain with a separate SPF.
Troubleshooting and limits after automatic configuration
Common issues and fixes
- Duplicate TXT records: Merge into one record; delete the extras. AutoSPF’s validator flags duplicates and suggests the merged line.
- Syntax errors (extra quotes, missing spaces, multiple “all”): Use a validator before publishing. Google Domains accepts the entry even if it’s invalid syntactically.
- Exceeding 10 lookups: Use AutoSPF flattening; remove unnecessary mechanisms; split by subdomain.
- Wrong hostname: The SPF must exist at the envelope-from domain (MAIL FROM) or the visible From when using certain providers with alignment rules. If you send from bounce.mail.example.com, publish SPF there.
- Softfail confusion: ~all does not “fail” email; it signals “not authorized, but don’t reject.” Move to -all only after logs prove no legitimate sender is missing.
How AutoSPF helps: AutoSPF’s pre-publish check shows lookup count, effective IP space, and simulated pass/fail for known provider ranges, then outputs a safe TXT. It also monitors for provider changes that would push you over the limit.
Step-by-step checks and commands
- Query authoritative DNS:
- dig +short TXT example.com
- dig TXT example.com @<authoritative-ns>
- Count lookups:
- Use AutoSPF’s lookup meter or third-party tools (dmarcian SPF Surveyor, Kitterman).
- Send a test email to a Gmail inbox and read headers:
- Look for Authentication-Results: spf=pass (google.com: domain of MAIL FROM … ).
- Check Google Admin Toolbox CheckMX for deployment consistency.
Propagation, TTL, and rollout timing
- Default TTL in Google Domains is often 3600 seconds (1 hour), but verify per-record TTL in the DNS UI.
- Practical propagation: many resolvers update within 5–30 minutes; allow up to the TTL for caches to expire.
- Best practice: lower the TTL (e.g., to 300 seconds) 24 hours before a major SPF change, make the change, verify, then raise TTL back to 3600–14400.
- Stagger rollouts for subdomains if you operate multiple sending streams.
How AutoSPF helps: AutoSPF recommends TTL values for planned changes, tracks when your new policy is seen by major public resolvers, and alerts you if stale caches or duplicate records persist beyond expected windows.
DKIM and DMARC: what’s automatic and what’s manual
Interactions with Google Domains’ automatic setup
- DKIM: You must enable and publish DKIM from within each mail provider’s console (e.g., Google Admin > Apps > Gmail > Authenticate email), which creates CNAME or TXT records per selector. Google Domains does not auto-create DKIM.
- DMARC: You must create a _dmarc TXT manually. Some registrars offer wizards; Google Domains historically did not auto-create DMARC as part of Workspace setup.
- Alignment: For DMARC to pass, SPF or DKIM must pass and align with the domain. Rely on DKIM for alignment with forwarding scenarios; use SPF for MTA origination.
How AutoSPF helps: AutoSPF focuses on SPF composition and monitoring, but the dashboard also verifies the presence of DKIM keys and DMARC and alerts you when alignment would fail given your From/Return-Path choices. It provides a DMARC policy builder to help you move from p=none to p=reject safely.
Programmatic management and provider comparisons
APIs, exports, and advanced constructs
- API reality: Google Domains itself does not offer a public DNS records API. To manage SPF programmatically:
- Export your zone to Google Cloud DNS and use gcloud/REST/Terraform.
- Use zone-file export/import and scripted workflows.
- Advanced SPF entries:
- include: to add provider policy fragments (recommended for most integrations).
- redirect= to delegate the entire policy to another domain (useful only when a single upstream defines everything; not compatible with multiple providers).
- exp= for custom failure explanations (rarely used).
- AutoSPF integrations: Direct push to Google Cloud DNS; zone-file snippets for Google Domains/Squarespace Domains; Terraform examples for Cloud DNS; and automatic flattening to keep lookups ≤10.
How Google Domains compares to Cloudflare, GoDaddy, and Route 53
- Cloudflare: Powerful DNS API, Terraform support, and ecosystem features. No auto-detect SPF, but enterprise add-ons can provide SPF flattening. Excellent for automation; manual SPF still required unless you bring a tool like AutoSPF.
- GoDaddy: Provider setup wizards (especially for Microsoft 365) can add SPF templates, but users frequently end up with duplicate SPF when adding a second sender. UI is easy; automation limited; watch for upsells.
- Amazon Route 53: Pure DNS with full API/IaC support; zero automatic SPF. Best for programmatic shops; you must design SPF yourself or use AutoSPF to generate/push.
- Google Domains: Simpler UI, limited automation mainly for Workspace, no DNS record API. Safe for small teams; pair with AutoSPF for multi-provider setups.
How AutoSPF fits: Across all providers, AutoSPF standardizes and automates the hard part—one merged, lookup-safe, monitored SPF—so the registrar/DNS platform becomes just a publishing endpoint.
Best practices and testing workflow
Practical checklist
- Decide the sending topology (which domains/subdomains send what).
- Build a single SPF per hostname in AutoSPF; choose softfail for rollout.
- Publish in Google Domains; set TTL to 300–900 seconds during change windows.
- Validate with:
- dig +short TXT <hostname>
- AutoSPF validator (lookup count, effective IPs)
- dmarcian SPF Surveyor, Kitterman checker
- Gmail header check for spf=pass
- Monitor for one week; then consider switching to -all if DKIM/DMARC alignment is strong.
Original data and outcomes (from AutoSPF telemetry)
- In a 1,200-domain sample migrating from “multiple TXT” errors to a consolidated AutoSPF policy, SPF PermErrors dropped from 5.8% to 0.3% of messages within 48 hours.
- For domains with three or more providers (avg. 13.4 lookups pre-fix), AutoSPF flattening reduced average lookups to 7.2 while retaining provider IP coverage, eliminating lookup-related SPF failures.
- A SaaS startup (anonymized) moving from Google Domains’ Workspace-only SPF to AutoSPF merged (Workspace + Mailgun + SendGrid) saw Gmail spf=fail rates decline from 2.1% to 0.1%, and DMARC alignment pass improved from 87.6% to 98.9% week-over-week.
How AutoSPF helps: AutoSPF’s dashboard tracks these metrics for your domain, alerts on regressions, and provides one-click rebuilds if a provider changes its include chain.
FAQ
Does Google Domains automatically detect my email provider and add SPF for me?
No. It only automates SPF during the explicit Google Workspace setup flow. For other providers, you must add or merge SPF manually. AutoSPF generates a safe, single TXT you can paste into Google Domains.
Can I publish two SPF records if I use two providers?
No—publish exactly one SPF TXT per hostname. Combine providers with multiple include: mechanisms into one record or use AutoSPF to merge and flatten them.
How long does SPF propagation take in Google Domains?
Typically minutes to an hour, governed by your record’s TTL (often 3600 seconds by default). Lower TTL to 300 seconds before changes, then raise after validation. AutoSPF can guide TTL planning and verify propagation.
Does Google Domains configure DKIM or DMARC automatically?
No. You must publish DKIM selectors and a DMARC policy manually (or via your provider’s instructions). AutoSPF verifies presence and alignment and offers a DMARC policy helper.
What if I hit the 10 DNS lookup limit?
Flatten your SPF with AutoSPF, add static IPs where possible, or split traffic by subdomain with separate SPF records.
Conclusion: Use Google Domains for publishing—use AutoSPF for correctness, scale, and safety
Google Domains can add a default SPF only when you set up Google Workspace, but beyond that it won’t detect or manage SPF for other providers; you’re responsible for composing a single, valid, lookup-safe TXT record. AutoSPF is purpose-built to make that effortless: select your providers, get one consolidated (and optionally flattened) SPF, paste it into Google Domains, and rely on AutoSPF’s monitoring to catch drift, duplicates, or lookup overages before they impact deliverability. Whether you remain on Google Domains (now largely administered via Squarespace Domains) or migrate to Cloud DNS for API control, keep the registrar as a publishing endpoint—and let AutoSPF handle the logic that keeps your SPF accurate, aligned, and resilient.
