How to set up DKIM for Google Workspace

Setting up DKIM for Google Workspace takes about 20 minutes of work, plus some waiting while your DNS record publishes. You'll need super administrator access to the Google Admin console and a login for the company that hosts your domain's DNS.

This guide follows Google's own steps, with notes on where people usually get stuck.

Why set up DKIM in Google Workspace?

DKIM adds a digital signature to every email your business sends. Receiving servers look up your public key in DNS and use it to confirm the message came from your domain and wasn't changed on the way.

It matters most for DMARC. DMARC passes when either SPF or DKIM passes and matches your domain. SPF often fails when an email is forwarded, so a DKIM signature is what keeps forwarded messages passing. Google's email sender guidelines also require every sender to set up SPF or DKIM, and bulk senders to set up both.

What do I need before I start?

• Sign in to the Google Admin console as a super administrator.
• Have a login for your DNS host. That's usually where you bought your domain, or Cloudflare if you moved your DNS there.
• If you only just turned on Gmail for your organization, wait. Google says to allow 24 to 72 hours before generating a DKIM key, or you may get an error.

If Squarespace is your domain provider, Google says the DKIM key is created and added for you, so you can skip ahead to turning on authentication.

How do I generate my DKIM key?

1. In the Google Admin console, go to Menu → Apps → Google Workspace → Gmail.
2. Click Authenticate email.
3. In the Selected domain menu, choose your domain.
4. Click Generate New Record.
5. Choose 2048 for the key length. Choose 1024 only if your DNS host doesn't support longer keys.
6. Leave the prefix selector as google, unless your domain already uses a DKIM key with that name for another service.
7. Click Generate, then copy the DNS Host name and TXT record value.

Don't click Start authentication yet. Google's page may say "You must update the DNS records for this domain" for up to 48 hours. You can ignore that once you've added the record.

What does the DKIM record look like?

The name is your selector followed by ._domainkey. Most DNS hosts add your domain to the end automatically, so enter only google._domainkey. If the record ends up as google._domainkey.yourbusiness.com.yourbusiness.com, edit the name down.

How do I add the record at my DNS host?

Paste the whole value into one TXT record. If your host rejects it or cuts it short, see the next section.

Check your SPF, DMARC and DKIM together

Our free checkup looks for DKIM at common selectors, including google, along with SPF, DMARC and your website basics.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

What if my DNS host says the key is too long?

Google's troubleshooting guide explains that most TXT records allow up to 255 characters per text string, and a 2048-bit key is longer than that. If your host truncates the key, DKIM will fail.

You have two options:

1. Split the value into two or more pieces, put each piece in double quotes, and enter them one after another in the same TXT record. The pieces join back together when servers read the record.
2. Go back to Google Admin and generate a 1024-bit key instead, then replace the record.

Ask your DNS host's support first. Many hosts accept the full value and split it for you.

How do I turn on DKIM signing?

Once the record has published, go back to the Authenticate email page:

1. In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
2. Select your domain.
3. Click Start authentication.

When it's working, the status at the top of the page changes to "Authenticating email with DKIM." If you get an error, the record probably hasn't published yet. Wait a few hours and try again.

How do I check that DKIM is working?

1. Send an email from your business address to someone on Gmail or another Google Workspace account. Google says sending a test to yourself won't verify it.
2. Open the message, click the three-dot menu next to Reply, and choose Show original.
3. Look for dkim=pass in the Authentication-Results line, with your domain after header.d=.

You can also re-run the free DMARC checker or a full CyberVigil scan, which looks for a key at the google selector.

What should you do next?

• Turn on DKIM for any other service that sends email as your domain, such as your newsletter or invoicing tool.
• Check your DMARC record with the DMARC checker, and move toward a quarantine policy using our DMARC policy guide.
• Work through the rest of our Google Workspace security checklist.