SPF record for Google Workspace and Zendesk
One record, both providers, and the honest lookup arithmetic so you know how much budget you have left.
The record
The single most common mistake here is publishing a second SPF record for the second provider — often because the provider's setup wizard says "add this TXT record". RFC 7208 §3.2 allows exactly one SPF record per domain. With two, receivers return permerror and treat your domain as having no SPF at all, which is strictly worse than having only one of the two providers listed.
The lookup budget
| Provider | Include | Lookups |
|---|---|---|
| Google Workspace | _spf.google.com | 1 |
| Zendesk | mail.zendesk.com | 1 |
Google flattened this record years ago — it is pure ip4/ip6 with no nested includes, so it costs exactly one lookup. It is one of the cheapest providers you can have in your record.
Use include:mail.zendesk.com (1 lookup). The bare zendesk.com record costs 7, because it chains _spf1 → _spf2 → _spf3 → _spf4 and ends with an a: lookup and a macro exists: term.
Check your own domain first
Before changing anything, see what you currently have. The checker expands your whole include chain and counts the lookups the way a receiver does.
DKIM for both
SPF covers the server; DKIM covers the message and survives forwarding. You need it from both providers independently:
| Provider | Selector | Published as |
|---|---|---|
| Google Workspace | CNAME-free TXT published by Google | |
| Zendesk | zendesk1 and zendesk2 | CNAME |
Different selectors do not conflict — that is exactly what selectors are for. A domain can carry any number of DKIM keys at once.
And DMARC on top
With two senders, DMARC reporting stops being optional. It is the only mechanism that tells you one of the two silently stopped authenticating.
Start there, then follow the staged rollout.
Lookup costs on this page were measured against live DNS on 2026-08-21 with the checker above, not copied from documentation. Providers do change their records — re-check yours rather than trusting a number in a blog post, including this one.
FAQ
How do I put both Google Workspace and Zendesk in one SPF record?
How many DNS lookups does that use?
Which order should the includes go in?
Related
Still broken after the DNS is right?
Email authentication is DNS. Payment notifications not arriving is usually not — it is a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced. That is what I fix: a fixed-fee $99 root-cause diagnosis, credited toward the repair.