Squarespace SPF, DKIM and DMARC Setup (Google Workspace or Microsoft 365)

Squarespace sells domains and can bundle Google Workspace, but it doesn't add a DMARC record for you, and Gmail and Yahoo now expect one from anyone sending regularly. Here's how to set up all three records on a Squarespace domain without breaking your email.

Before you start: is DNS actually in Squarespace?

Open your Squarespace domains dashboard, click the domain, then click DNS. If you can edit records there, you're in the right place. If the domain is registered elsewhere and only connected to your site (for example a GoDaddy domain pointing at Squarespace), add these records at that registrar instead. Check with dig +short NS yourdomain.com.

Step 1: Make sure email routing (MX) is set

If you bought Google Workspace through Squarespace, the MX records are usually already there. If you bought it directly from Google, connect the domain from the Google Admin console and approve the Squarespace sign-in; Google adds the MX and verification records for you.

Connection error? That usually means old mail records or email forwarding rules are already on the domain. In Squarespace DNS, delete existing MX, SPF, and DKIM records and any email forwarding entries, then retry the connection. Only do this if you're not currently relying on that old email setup.

Step 2: Add one SPF record

In DNS, under custom records, add a TXT record:

Type: TXT
Host: @
Value (Google Workspace): v=spf1 include:_spf.google.com ~all
Value (Microsoft 365):    v=spf1 include:spf.protection.outlook.com ~all

If you also send from Mailchimp, Squarespace Email Campaigns, or a CRM, add their include: to the same record. Two separate SPF records make SPF fail entirely. Stay under 10 DNS lookups; see our SPF too-many-lookups fix if you're close.

Step 3: Turn on DKIM

Google Workspace: in the Admin console go to Apps, Google Workspace, Gmail, then Authenticate email. Generate a new record (2048-bit if Squarespace accepts the length), and add it as a TXT record in Squarespace with Host google._domainkey and the long value Google shows. Wait about 30 minutes, then return and click Start authentication. It can take up to 48 hours to verify.

Microsoft 365: in the Defender portal's DKIM settings, select your domain. It gives you two CNAME records (selector1._domainkey and selector2._domainkey). Add both in Squarespace, then switch DKIM signing on.

Not sure it worked? Our DKIM checker guide shows how to find your selector and test it.

Step 4: Add DMARC

Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:you@yourdomain.com

Start at p=none, which only collects reports. After two to four weeks, once the reports show your real senders passing, move to p=quarantine and later p=reject. Keep only one DMARC record, and put it on _dmarc, not on @.

Step 5: Verify

dig +short TXT yourdomain.com
dig +short TXT _dmarc.yourdomain.com

Then send a message to a Gmail address, open it, choose Show original, and confirm SPF, DKIM, and DMARC all say PASS. Squarespace says DNS changes can take up to 48 hours, so give it time before changing things again.

Common Squarespace mistakes

• Typing the full domain into Host. Use @ for the root and _dmarc for DMARC.
• Leaving an old SPF record from a previous host next to the new one.
• Forgetting the Start authentication step in Google, so DKIM never signs.
• Jumping straight to p=reject before checking that newsletters and forms pass.

Using a different builder? See our Wix guide or Shopify guide.

Check it the fast way

Want a second opinion in under a minute? Scan your site free with SiteShield. It checks your SPF record and DMARC policy, plus SSL, security headers, and privacy basics on your Squarespace site and shows your score and every issue found. If you'd rather skip the trial and error, the $14 fix bundle gives you copy-paste fixes written for your exact site.

Check your site free