On this page

Fixing SPF in AWS Route 53 for Google Workspace

What this fixes

SPF lists which servers are authorized to send mail for your domain. See Fixing SPF Record Issues for what it does and why it matters — this guide gives you the exact record for Google Workspace and where to add it in Route 53.

This assumes you already have a hosted zone in Route 53 for your domain, and IAM permissions to edit it.

The record

v=spf1 include:_spf.google.com ~all

Google's own guidance recommends ~all (soft fail) rather than -all. If you send mail through other services too, add their include: mechanisms alongside Google's in the same record.

How to add it in Route 53

  1. Open the Route 53 console and go to Hosted zones → select your domain's hosted zone.
  2. Click Create record.
  3. Leave Record name as your root domain.
  4. Set Record type to TXT.
  5. Under Value, enter the record in quotes: "v=spf1 include:_spf.google.com ~all" — Route 53 requires TXT values to be wrapped in double quotes.
  6. Leave TTL at the default (300s is fine).
  7. Click Create records.
  8. Re-run your scan to confirm.

If an SPF TXT record already exists, edit it rather than creating a second one.

Common pitfalls

  • Forgetting to wrap the TXT value in double quotes — Route 53 will otherwise reject or mis-parse the record.
  • Creating a second SPF TXT record instead of editing the existing one.