SPF record for Google Workspace and Freshdesk
One record, both providers, and the honest lookup arithmetic so you know how much budget you have left.
The record
The single most common mistake here is publishing a second SPF record for the second provider — often because the provider's setup wizard says "add this TXT record". RFC 7208 §3.2 allows exactly one SPF record per domain. With two, receivers return permerror and treat your domain as having no SPF at all, which is strictly worse than having only one of the two providers listed.
The lookup budget
| Provider | Include | Lookups |
|---|---|---|
| Google Workspace | _spf.google.com | 1 |
| Freshdesk | email.freshdesk.com | 7 |
Google flattened this record years ago — it is pure ip4/ip6 with no nested includes, so it costs exactly one lookup. It is one of the cheapest providers you can have in your record.
The single most expensive common include measured here: 7 of your 10 lookups, because it nests SendGrid plus four regional Freshemail records. If you use Freshdesk, sending support mail from a subdomain is close to mandatory.
Two providers already account for 8 of your 10. Adding a helpdesk, a CRM and a payment provider on top of this will cross the limit. If you expect more senders, move one of these to a subdomain now — each domain gets its own separate budget, and doing it before you break is far easier than after.
Check your own domain first
Before changing anything, see what you currently have. The checker expands your whole include chain and counts the lookups the way a receiver does.
DKIM for both
SPF covers the server; DKIM covers the message and survives forwarding. You need it from both providers independently:
| Provider | Selector | Published as |
|---|---|---|
| Google Workspace | CNAME-free TXT published by Google | |
| Freshdesk | freshdesk | CNAME |
Different selectors do not conflict — that is exactly what selectors are for. A domain can carry any number of DKIM keys at once.
And DMARC on top
With two senders, DMARC reporting stops being optional. It is the only mechanism that tells you one of the two silently stopped authenticating.
Start there, then follow the staged rollout.
Lookup costs on this page were measured against live DNS on 2026-08-21 with the checker above, not copied from documentation. Providers do change their records — re-check yours rather than trusting a number in a blog post, including this one.
FAQ
How do I put both Google Workspace and Freshdesk in one SPF record?
How many DNS lookups does that use?
Which order should the includes go in?
Related
Still broken after the DNS is right?
Email authentication is DNS. Payment notifications not arriving is usually not — it is a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced. That is what I fix: a fixed-fee $99 root-cause diagnosis, credited toward the repair.