How to set up DKIM in Google Workspace

Before you begin

• You need to be a super administrator (the Gmail page also needs the Gmail Settings administrator privilege).
• Just turned on Gmail? Google says to wait 24–72 hours before generating the key. Earlier attempts can fail with an error that the DKIM record wasn't created.
• Domain at Squarespace? Google says the key is created and added to DNS automatically; skip to turning it on.
• Bought the domain from a Google partner at sign-up? DKIM may already be set up. Run the check above with selector google to see.
• Using an outbound gateway that changes messages, for example adding a footer? Make sure it doesn't break the signature.

1. Generate the DKIM key

1. In the Google Admin console, go to Menu → Apps → Google Workspace → Gmail.
2. Click Authenticate email.
3. In the Selected domain menu, pick the domain to set up.
4. Click Generate New Record.
5. Choose the DKIM key bit length: 2048 if your DNS host supports 2048-bit keys (Google's recommendation: longer keys are more secure), otherwise 1024.
6. Keep the prefix selector google, the default Google recommends. Enter a different one only if your domain already has a DKIM key named google.
7. Click Generate. The page shows “DKIM authentication settings updated” and the new TXT record value.

2. Publish the TXT record

Copy the two values from the Authenticate email page, the DNS Host name (TXT record name) and the TXT record value, and add them at your DNS host, usually where you bought the domain:

• Most DNS panels want just google._domainkey in the host field and add your domain themselves.
• Some DNS hosts limit TXT record length. Google's DKIM troubleshooting page explains how to handle a 2048-bit key there; many panels split long values into quoted strings automatically.
• Setting up several domains? Each one needs its own key from the Admin console.

Once it's saved, enter your domain and selector google in the check at the top of this page. It reads the key from public DNS and tells you if it's missing, truncated or shorter than expected.

3. Start authentication

1. Back in the Admin console, go to Apps → Google Workspace → Gmail → Authenticate email and select the domain.
2. Click Start authentication. When it works, the status at the top changes to “Authenticating email with DKIM”.

Google says DKIM can take up to 48 hours to start working after you add the key, and the Admin console may keep showing “You must update the DNS records for this domain” for up to 48 hours. If the check above finds your key, you can ignore that message.

4. Confirm it works

1. Send a message to someone on Gmail or Google Workspace. Google notes you can't verify DKIM by sending a test to yourself.
2. In the recipient's Gmail, open the message, click More → Show original, and find Authentication-Results.
3. Look for dkim=pass with header.d= set to your domain. Paste the headers into the header analyzer to see alignment at a glance.

DKIM is one of three records. The Google Workspace setup guide covers SPF and DMARC, which Google requires together with DKIM from bulk senders.

Questions