How to Set Up DKIM in Google Workspace (Step-by-Step)

DKIM for Google Workspace takes about 10 minutes: generate the key in Admin console, publish the resulting TXT record, verify.

Prerequisites

Google Workspace Admin access (super admin or Gmail admin)
DNS host access

Step 1 — Generate the DKIM Key

Open Google Admin console → Apps → Google Workspace → Gmail → Authenticate email
Select your domain
Click Generate new record
Choose 2048 bit key length (recommended — do not pick 1024)
Optionally set a custom selector (default is google)
Click Generate

Google displays a DNS TXT record — two fields:

DNS Host name (TXT record name) — google._domainkey
TXT record value — starts with v=DKIM1; k=rsa; p=MIGfMA0G... (long)

Copy both to a scratch pad.

Step 2 — Publish the TXT Record

At your DNS host:

Name — google._domainkey (or your custom selector name)
Type — TXT
Value — the full v=DKIM1; k=rsa; p=... string
TTL — Auto or 3600

For DNS hosts that require string splitting on long records (Route 53), most modern UIs handle it automatically.

Provider-specific: our Cloudflare TXT guide and Route 53 TXT guide cover the UI.

Step 3 — Wait for DNS Propagation

Wait 5-30 minutes. Verify the record is published with the DKIM lookup tool — enter your domain and selector (google).

Expected result: valid public key found, correct algorithm, key length 2048.

Step 4 — Start Authentication in Google Admin

Back in Admin console → Authenticate email:

Click Start authentication
Google verifies the DNS record
If successful, Google begins signing outbound mail immediately

Step 5 — Verify With a Test Message

Send a message from a Google Workspace mailbox to an external inbox (Gmail personal, Outlook.com). Open the message headers:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yourdomain.com;
    s=google; t=1735689600; ...
Authentication-Results: mx.google.com;
    dkim=pass header.i=@yourdomain.com header.s=google;

dkim=pass confirms Google is signing correctly and the receiver verified it against your DNS record.

Step 6 — Rotate Every 6 Months

DKIM keys should be rotated periodically. In Admin console → Authenticate email, generate a new record with a new selector name (e.g., google2026a → google2026b six months later). Publish the new selector; wait a week; delete the old.

Common Miss

Choosing 1024-bit key length — modern minimum is 2048
Wrong selector — record must be at {selector}._domainkey.yourdomain.com
Forgetting to click Start authentication — record is published but Google isn’t signing
Not verifying with a test send — assume it works, discover it doesn’t when bounces arrive

Verify with the DKIM lookup tool and the email authentication checker.

Read what DKIM is, check the DKIM glossary entry, and see the DKIM selector glossary entry for rotation strategy.