How to Update DNS Records in Google Domains (Squarespace Domains)

Google Domains was a domain registrar operated by Google that offered a clean, developer-friendly DNS management interface. In 2023, Google sold its domain registration business to Squarespace. Domains originally registered through Google Domains are now managed through Squarespace Domains, though many still use the original Google Domains nameserver infrastructure. This guide covers DNS management for domains that were registered through Google Domains and are now managed through Squarespace Domains. Each section includes the exact steps, correct field values, and provider-specific details to get your email authentication records configured correctly.

If your domain was registered with Google Domains and you have not changed your nameservers, your DNS zone is still served by Google's nameserver infrastructure. The management interface, however, has been migrated to Squarespace.

Accessing Your DNS Zone

1. Sign in to your Squarespace Domains account at domains.squarespace.com. If you originally used Google Domains, you were prompted to migrate your account to Squarespace.
2. Select the domain you want to manage from the domain list.
3. Click DNS or DNS Settings in the left sidebar.
4. You are now in the DNS management page where you can view, add, edit, and delete DNS records.

The DNS interface displays records in a clean table format organized by type. To add a new record, click Add Record or the + button. To edit an existing record, click on the record to expand it for editing.

Note: If your domain uses custom nameservers (not the default Google/Squarespace nameservers), DNS records must be managed at the provider hosting your zone. Check your nameserver configuration in the domain settings.

TXT Records

SPF Record

SPF (Sender Policy Framework) tells receiving mail servers which IP addresses and services are authorized to send email for your domain. Your SPF record is published as a TXT record at the root of your domain.

1. In the DNS Settings page, click Add Record in the Custom records section.
2. In the Host name field, enter @. The interface uses @ to represent the root of your domain.
3. Select TXT from the Type dropdown.
4. In the Data field, enter your SPF record: v=spf1 include:_spf.mxio.io ~all
5. Set the TTL to 3600 (1 hour) or leave it at the default if no TTL option is presented.
6. Click Save or the checkmark button.

If you already have an SPF record, do not create a second one. Multiple SPF records cause a PermError and break email authentication entirely. Edit the existing TXT record that begins with v=spf1 and add include:_spf.mxio.io before the ~all or -all mechanism.

Google Domains/Squarespace-specific note: If your domain previously used Google Workspace email, you may already have an SPF record that includes _spf.google.com. If you still use Google Workspace for email, keep that include and add the mxio include alongside it: v=spf1 include:_spf.google.com include:_spf.mxio.io ~all

DMARC Record

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving servers how to handle email that fails SPF and DKIM checks. It also enables aggregate reporting so you can see who is sending email as your domain.

1. Click Add Record.
2. In the Host name field, enter _dmarc. The interface will append your domain, resulting in _dmarc.yourdomain.com.
3. Select TXT from the Type dropdown.
4. In the Data field, enter your DMARC policy: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
5. Click Save.

Replace dmarc@yourdomain.com with the address where you want to receive DMARC aggregate reports. Start with p=none to collect data before enforcing. See the DMARC Deployment Guide for the full progression from none to quarantine to reject.

Note: mxio will support DMARC policy management in a future release.

CNAME Records

MTA-STS

MTA-STS (Mail Transfer Agent Strict Transport Security) tells sending servers that your domain supports TLS encryption for inbound email and that they should refuse to deliver over an unencrypted connection. The MTA-STS policy is published via HTTPS, and a CNAME record points to the policy host.

1. Click Add Record.
2. In the Host name field, enter _mta-sts. The interface will append your domain automatically.
3. Select CNAME from the Type dropdown.
4. In the Data field, enter the CNAME target provided by your MTA-STS hosting service.
5. Click Save.

You also need a TXT record at _smtp._tls to publish the MTA-STS policy version identifier. Follow the same TXT record process described above, using _smtp._tls as the Host name and the policy string as the Data.

Note: mxio will support MTA-STS hosting in a future release.

NS Delegation

DKIM Key Hosting

DKIM (DomainKeys Identified Mail) uses cryptographic signatures to verify that an email was sent by an authorized server and that the message body was not altered in transit. DKIM keys are published as DNS records under the _domainkey subdomain.

For centralized DKIM key management, you can delegate the _domainkey subdomain to a dedicated DNS host via NS records.

1. Click Add Record.
2. In the Host name field, enter _domainkey. The interface will append your domain, resulting in _domainkey.yourdomain.com.
3. Select NS from the Type dropdown. If NS is not available in the record type options, the Squarespace Domains interface may not support custom NS records — see the troubleshooting section below.
4. In the Data field, enter the first nameserver provided by your DKIM hosting service.
5. Click Save.
6. Repeat for each additional nameserver (typically 2-4 NS records are required for redundancy).

Note: mxio will support DKIM key hosting via NS delegation in a future release.

Verifying Your Changes

After adding or editing DNS records, verify that your changes are live and correct.

1. Use the mxio SPF Checker to validate your SPF record. Enter your domain and confirm that the record resolves correctly, the lookup count is within the 10-lookup limit, and all your sending services are included.
2. Use the mxio DMARC Checker to verify your DMARC record is published and syntactically correct.
3. Use the mxio Domain Health tool for a full overview of your domain's email authentication status, including SPF, DKIM, DMARC, and MX configuration.
4. If you created NS delegation records for DKIM, use the Delegation Health tool to verify that the NS records are resolving correctly and the delegated zone is responding.

DNS propagation from Google Domains/Squarespace Domains typically takes 5 minutes to 1 hour. The underlying Google nameserver infrastructure provides fast propagation globally. If your changes are not appearing immediately, clear your local DNS resolver cache and check again.

Troubleshooting

Account migration from Google Domains to Squarespace

If you have not completed the migration from Google Domains to Squarespace Domains, your DNS management interface may be temporarily unavailable or may redirect to the migration flow. Complete the migration to regain full access to DNS management. Your DNS records and nameserver configuration are preserved during the migration.

Duplicate SPF records

Your domain must have exactly one SPF TXT record at the root. If you see two TXT records starting with v=spf1, delete one and merge the include mechanisms into a single record. Use the SPF Checker to confirm you have only one record after merging.

Host name field format

The interface uses @ to represent the root domain. For subdomains, enter only the subdomain portion — the domain is appended automatically. For example, to create a record at _dmarc.yourdomain.com, enter _dmarc in the Host name field.

NS records not supported

The Squarespace Domains interface may not expose NS record creation for subdomains through the standard DNS management page. If NS delegation is not available in the record type dropdown, you may need to contact Squarespace support to request NS records for the _domainkey subdomain, or consider migrating your DNS hosting to a provider with full record type support.

Google Workspace DKIM records

If you use Google Workspace, Google provides specific CNAME or TXT records for DKIM signing. These DKIM records are separate from the NS delegation approach described in this guide. If you only need Google Workspace DKIM (selectors google and/or a custom selector), follow Google Workspace's DKIM setup instructions and add the records as TXT or CNAME records directly, without NS delegation.

Squarespace website DNS conflicts

If your domain hosts a Squarespace website, Squarespace may have auto-configured A and CNAME records for web traffic. These records do not conflict with TXT records for SPF and DMARC, but be aware that editing DNS records for a domain with an active Squarespace website requires caution — do not delete the A, AAAA, or CNAME records that serve the website.