How to Configure DKIM Records inside Google Workspace Admin Console

Configuring DomainKeys Identified Mail (DKIM) in Google Workspace involves generating a cryptographic key pair inside your Google Admin console and publishing the public record to your DNS host. This process cryptographically signs your outbound emails, proving to receiving mail servers that messages genuinely originate from your domain and have not been altered in transit. Without proper setup, your legitimate outreach and transactional emails risk landing in spam folders or facing outright rejection under modern DMARC policies.

To ensure your domain is fully optimized and secure, you can use the Email Security Checker to instantly verify your DNS setup, inspect active DKIM selectors, and confirm that receiving servers can successfully validate your outgoing message signatures.

Prerequisites Before You Begin

Before diving into the Google Admin console, you need administrative access to two distinct locations: your Google Workspace super administrator account and the management portal of your DNS hosting provider (such as Cloudflare, GoDaddy, AWS Route 53, or Namecheap).

You should also decide on your selector prefix. The default selector for Google Workspace is google, but you can customize this if you run multiple mail streams or rotate keys periodically. Ensure you have access to your domain's DNS zone file editor and understand how to add custom TXT records.

Step 1: Generate DKIM Records in Google Workspace

The first phase of the setup happens entirely inside your Google Admin console, where Google generates your unique public and private key pair.

1. Sign in to the Google Admin console using an account with super administrator privileges.
2. In the navigation menu, go to Apps > Google Workspace > Gmail > Authenticate email.
3. If you manage multiple domains, select the specific domain you want to configure from the organizational unit or domain selector at the top.
4. Click Generate new record.
5. Review the default settings:
   • DNS host name (selector): Keep the default value of google unless you have a specific reason to change it.
   • Bit length: Choose either 2048-bit or 1024-bit. Always select 2048-bit unless your DNS provider has documented limitations that prevent long TXT records. 2048-bit keys provide significantly stronger cryptographic security.
6. Click Generate. Google has now created your public key and stored the private key securely on its sending infrastructure.

Step 2: Publish the TXT Record to Your DNS Provider

Once the key is generated, Google displays a TXT record name (Host Record) and a TXT record value. You must copy these exact strings and paste them into your DNS provider's management console.

1. Copy the TXT record name (often displayed as google._domainkey or simply google._domainkey.example.com depending on your DNS host).
2. Copy the long string starting with v=DKIM1; k=rsa; p=... from the TXT record value field.
3. Log into your DNS provider's dashboard and navigate to your domain's DNS record management page.
4. Create a new record with the following parameters:
   • Type: TXT
   • Name / Host: google._domainkey (Note: Many DNS providers automatically append your root domain name, so entering google._domainkey results in google._domainkey.example.com. Check your provider's formatting rules).
   • Value / Content: Paste the entire RSA public key string provided by Google.
   • TTL (Time to Live): Set to 3600 seconds (1 hour) or the provider default.
5. Save the DNS record.

Step 3: Turn on Email Authentication in Google Workspace

Publishing the DNS record alone does not start the signing process. You must instruct Google Workspace to begin signing outbound mail with your new key.

1. Return to the Authenticate email page in your Google Admin console (Apps > Google Workspace > Gmail > Authenticate email).
2. Locate the domain you just configured.
3. Click Start authentication.
4. The status indicator next to your domain will change to indicate that authentication is active. Google will now begin cryptographically signing all outgoing messages sent through its SMTP servers for this domain.

Note: DNS changes require time to propagate globally. If you click Start authentication immediately after saving your DNS record, Google may throw an error stating the record cannot be found. Wait 15 to 60 minutes for DNS propagation before turning on authentication.

Step 4: Verify Your DKIM Configuration

After turning on authentication and waiting for propagation, you must verify that emails are successfully signed and validated by external servers. You can use command-line tools or online diagnostics to check your setup.

To check your DNS public record using dig in your terminal, run:

dig TXT google._domainkey.example.com

Expected output sample:

;; ANSWER SECTION:
google._domainkey.example.com. 3600 IN TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

To verify active email signing, send a test email from your Google Workspace account to an external testing address (such as a personal Gmail account), open the raw message source (Show original), and look for the authentication headers:

Authentication-Results: mx.google.com;
       dkim=pass header.i=@example.com header.s=google header.b=AbCdEfGh

Common Mistakes and How to Fix Them

Even experienced administrators occasionally run into issues when deploying email authentication. Here are the most frequent pitfalls and how to resolve them:

• Double-Appending Domain Names: Many DNS panels automatically append your root domain to the Host field. If you enter google._domainkey.example.com into a tool like Cloudflare, it may mistakenly create google._domainkey.example.com.example.com. Always check your DNS provider's zone file preview to ensure the host reads strictly as google._domainkey.
• Truncated Public Keys: 2048-bit keys are extremely long. Some older DNS management interfaces have character limits or automatically wrap text in ways that corrupt the base64 string. Ensure the entire key is pasted into a single unbroken string if your provider allows it.
• Premature Activation: Clicking "Start Authentication" before your DNS changes have propagated will result in delivery failures or unverified messages. Always verify the record is resolvable via public DNS lookup tools first.

Configuration Checklist

• Generated a 2048-bit DKIM key pair in the Google Admin console.
• Copied the exact selector and public key value.
• Created a TXT record with your DNS host without domain duplication.
• Waited for DNS propagation (up to 24 hours globally, typically 15 minutes).
• Clicked "Start Authentication" in the Google Admin console.
• Sent a test email and confirmed dkim=pass in the message headers.