Cloudflare Set up Google Workspace DNS records: A Guide for Website Owners

To set up Google Workspace DNS records for a domain managed in Cloudflare, add Google's verification TXT record at @, add Google's five MX records, and then publish SPF, DKIM, and DMARC records in Cloudflare DNS. Verify ownership in Google Admin after saving the TXT record. Cloudflare's instructions below apply when Cloudflare manages the domain's DNS records.

Verify domain ownership#

1. In the Google Admin console, start the domain setup wizard and copy the TXT verification value Google provides.
2. In the Cloudflare dashboard, select the account and domain, then open DNS > Records.
3. Select Add record and enter:

• Type: TXT
• Name: @, representing the root domain
• Content: the exact verification value copied from Google
• Proxy status: DNS only

1. Select Save.
2. Return to Google Admin and select Verify.

Google typically verifies within a few minutes, but DNS propagation can take up to 48 hours. If an external DNS tool does not show the TXT record, confirm that the name is @, not www, and allow more time for propagation.

Route incoming email to Google#

MX records direct incoming email to Google's mail servers. Before adding them, remove MX records that point to another mail provider. Google Workspace requires these five records:

Swipe or scroll horizontally to read every column →

Set each record to DNS only. Cloudflare states that MX and TXT records are always DNS-only, so the proxy option is unavailable for these record types.

Cloudflare Email Routing and Google Workspace MX records cannot coexist on the same domain because both require control of the domain's MX records. If Email Routing is active, disable it under Email > Email Routing before adding the Google MX records.

Add SPF, DKIM, and DMARC#

SPF#

In DNS > Records, add a TXT record with:

• Name: @
• Content: v=spf1 include:_spf.google.com ~all
• Proxy status: DNS only

Your domain should have exactly one SPF record. If other services also send mail for the domain, add their include: entries to this same SPF record rather than creating another TXT record that begins with v=spf1. Multiple SPF records can cause SPF failures.

DKIM#

1. In Google Admin, go to Apps > Google Workspace > Gmail > Authenticate email.
2. Select the domain and choose Generate new record. Cloudflare's instructions recommend a 2048-bit key length for stronger security.
3. Copy the complete TXT value Google displays. It begins with v=DKIM1; k=rsa; p=.
4. In Cloudflare DNS, add a TXT record with the selector Google specifies, typically google._domainkey, and paste the value into Content.
5. Keep the record DNS only, return to Google Admin, and select Start authentication.

Allow a few minutes for propagation before checking whether Google confirms DKIM is active.

DMARC#

In Cloudflare DNS, add a TXT record with:

• Name: _dmarc
• Content: begin with v=DMARC1; p=none; and include a rua=mailto: destination for an address where you want to receive aggregate reports
• Proxy status: DNS only

Use an email address you control for the report destination. Cloudflare recommends beginning with p=none while you monitor results and confirm that legitimate mail passes SPF and DKIM. After reviewing the reports, you can change the policy to p=quarantine or p=reject.

Apply common records to multiple domains#

Cloudflare documents an export and import method for domains using the same Google Workspace account:

1. Complete the DNS setup manually on the first domain.
2. In DNS > Records, select Export to download the zone as a BIND-format file.
3. Edit the file to remove records that should not be copied, such as the website's A and AAAA records. Keep the common MX, SPF, and DMARC records.
4. For each additional domain, open DNS > Records > Import and upload the edited file.

Each domain needs its own DKIM key. Generate a separate key in Google Admin and add that DKIM record individually after importing the common records.

Other setup problems#

If Google reports Domain already in use, Cloudflare identifies this as a Google-side state: the domain was previously connected to another Google Workspace account and was not fully released. Ask the previous administrator to remove it, or contact Google Workspace support to submit a domain claim.