How to Turn On DKIM in Google Workspace

What you will need: your Google Workspace admin login, and access to wherever your domain's DNS is managed (for example GoDaddy, Cloudflare, or your web host).

What DKIM is, and why it matters

DKIM (DomainKeys Identified Mail) is like a tamper-evident seal on your outgoing email. Your email system stamps each message with a hidden digital signature. The receiving mail server checks that signature against a public key you've published in your domain's DNS (the system that tells the internet where your website and email live). If the signature matches, the receiver knows the message really came from your domain and wasn't altered on the way.

DKIM also matters for DMARC, a policy that tells receiving servers what to do with mail that fails authentication checks. DMARC relies on DKIM, SPF (a separate check), or both. Without DKIM turned on, you have less to stand on if you set up DMARC. For the bigger picture on mail landing in spam, see our guide, Why Your Business Emails Land in Spam (and How to Fix It).

If you got here from our Email Setup Check, the DKIM card said it detected Google Workspace but couldn't confirm DKIM. That doesn't always mean DKIM is off. Start with the quick check below.

Step 1: Check first, because you may already have it

1. Send an email from your Google Workspace address to an address outside your company, such as a personal Gmail account. Sending a test to yourself doesn't verify DKIM.
2. Open the message you received. Next to Reply at the top right of the message, click More (⋮), then choose Show original.
3. Look at the box at the top of the page for a line like this: DKIM: PASS with domain example.com. Your own domain should appear in place of example.com.

If you see PASS with your own domain, DKIM is working and you can stop here. If the domain shown is not yours, or the result is FAIL or missing, DKIM isn't set up for your domain yet. Keep going.

Step 2: Generate your DKIM record in the Admin console

The Admin console is Google's control panel for your Workspace account (admin.google.com). You'll generate a unique DKIM "key" there, which Google gives you as a long string of text.

1. Sign in to the Admin console with a super administrator account.
2. Go to Apps → Google Workspace → Gmail → Authenticate email.
3. If you have more than one domain, pick the right one from the domain drop-down at the top.
4. Click Generate new record.
5. Choose your key length. The two options are 2048 and 1024 bits, which is simply how long and strong the key is. We suggest 2048 when you can use it. Some DNS hosts can't accept records that long. If yours rejects the 2048 value in Step 3, come back and generate a 1024 key instead.
6. Leave the Selector prefix as google unless you have a reason to change it. A selector is a label that lets a domain have more than one DKIM key.
7. Click Generate.

Google will now show you two things. Keep this page open, because you'll copy from it next:

• DNS Host name (TXT record name): google._domainkey
• TXT record value: a long string that starts with something like v=DKIM1; k=rsa; p=...

A TXT record is simply a line of text stored in your DNS settings. Here, it holds your public key.

Step 3: Add the TXT record at your DNS host

Your DNS host is the company where your domain's DNS settings live. It may be different from where you bought the domain, or from where your website is hosted. If you aren't sure where it is, your domain registrar's account is the usual place to look.

1. Log in to your DNS host and open the DNS settings for your domain. It may be called "DNS Management," "DNS Records," or "Zone Editor."
2. Add a new record and set the Type to TXT.
3. In the Host (sometimes called Name) field, enter: google._domainkey
4. In the Value (sometimes called Content or TXT Value) field, paste the long string from Google exactly as shown. Don't add spaces, line breaks, or quote marks of your own.
5. Leave the TTL (how long other systems may keep a saved copy of the record) at its default.
6. Save the record.

The most common mistake

Many DNS hosts automatically add your domain name to the end of whatever you type in the Host field. If you enter google._domainkey.example.com, the host may create google._domainkey.example.com.example.com, which won't work.

Enter only google._domainkey. After saving, look at how the record is displayed. If you see your domain name doubled, edit the record and remove the extra part. A few hosts do want the full name, so if the display shows exactly google._domainkey.example.com, it's correct.

Step 4: Wait, then start authentication

DNS changes need time to spread across the internet. This is often called propagation. It can take up to 48 hours before Google can see the record.

Once you've given it some time:

1. Go back to Apps → Google Workspace → Gmail → Authenticate email in the Admin console.
2. Select your domain.
3. Click Start authentication.

If it works, the status at the top of the page will change to “Authenticating email with DKIM.” If you get an error, jump to the troubleshooting section below.

Step 5: Check your work

1. Run our Email Setup Check again.
2. Open the option labeled I know my DKIM selector and enter google.
3. Check the DKIM result card.
4. Repeat the Show original test from Step 1. Send a fresh message, because older messages won't show the change. You should now see DKIM: PASS with domain example.com (with your own domain).

Troubleshooting

Start authentication is greyed out, or you get an error. The most likely cause is that Google can't find your record yet. Wait longer, then confirm the record is saved with the host name google._domainkey and not a doubled domain name. Also confirm the value is the one from the domain you selected in the Admin console.

Your DNS host split the value into several quoted pieces. Some hosts break very long values into multiple quoted strings. That is often fine, since DNS can join them back together. It becomes a problem if the pieces were cut in the wrong place or the host added stray characters. If it won't validate, delete the record and paste it again.

There are extra quote marks in the value. Some DNS hosts add quotes for you, and pasting your own on top creates doubles. Paste the value without quotes first, then check how the host stores it.

The record is too long for your DNS host. Generate a 1024-bit key in the Admin console and use the new value.

You have more than one domain. Each domain in the Admin console’s drop-down needs its own DKIM key and TXT record. Repeat the steps for each one.

If you'd rather have us handle this for you, use the "Get help with this" button on your Email Setup Check results or send us a message through our contact form.