Common Misconfigurations in Google Workspace Email Security (and How to Fix Them)

Email security is critical for every business. Google Workspace provides powerful tools to secure your domain and your emails, though small mistakes in setup can leave the door open for spoofing, phishing, and failed message delivery. In this post, we'll walk through the most common misconfigurations we see in Google Workspace and how to fix them.

1. Missing or Incorrect SPF Records

Businesses often forget to update their SPF record when adding new email-sending services (like CRMs, billing platforms, or marketing tools). Many companies also use dedicated email marketing platforms to reach their customers, but overlook adding them to their SPF record. The default SPF record in Google Workspace works very well for Gmail and other Workspace services, but it does not automatically cover third-party senders. This mismatch causes emails to fail SPF checks, even if the sender is legitimate. How to fix:

• Ensure your DNS records include all legitimate senders.
• A simple Google Workspace SPF record looks like:

v=spf1 include:_spf.google.com -all

• Add additional services (e.g., Mailchimp, Sendgrid, HubSpot, billing apps) using include: statements so they are recognized as authorized senders.

2. DKIM Not Enabled

By default, Google Workspace does not enable DKIM signing. Many domains run without it, leaving messages unprotected against tampering. In addition to tampering, not configuring DKIM can result in DMARC failures and legitimate emails landing in spam folders. Worse, the absence of DKIM sends a signal to nefarious actors that your online security posture might be weak, making your domain a more attractive target for scrutiny and abuse. How to fix:

• In the Google Admin Console → Apps → Google Workspace → Gmail → Authenticate Email.
• Generate DKIM keys and publish the DNS CNAME records.
• Click Start Authentication to activate DKIM.

3. Weak or Misaligned DMARC Policy

Some businesses either don't publish a DMARC record at all, or use a misaligned record (wrong syntax, missing semicolons, or set permanently to p=none). Many hosting providers do not automatically create DMARC records when you buy a domain, which leaves the domain exposed by default. Since DMARC records are essential to the security of emails, providing alignment between SPF/DKIM and the “From” address—this omission prevents DMARC from enforcing protection and allows spoofed messages to slip through. How to fix:

• Start with a simple record:

v=DMARC1; p=none; rua=mailto:mm@lappuai.com

• Gradually move to stricter policies (quarantine → reject) once reports confirm legitimate mail is properly authenticated.

4. Forgotten Subdomains

Even if the main domain is secured, subdomains (e.g., mail.yourdomain.com, info.yourdomain.com) may be left unprotected. Attackers exploit this gap for spoofing. How to fix:

• Add SPF/DKIM/DMARC records for subdomains.
• Or enforce subdomain protection in the main DMARC record using: sp=reject Securing Google Workspace email goes beyond turning on default settings. By fixing these common misconfigurations SPF, DKIM, DMARC, subdomains you not only protect your domain from spoofing but also strengthen customer trust. Lappu AI subscribers get access to premium tools for validating their DMARC, SPF configurations. Lappu AI provides services to get you to a secure email posture.