How to set up DKIM for Google Workspace

DKIM signs your outgoing mail with a key only your sender holds, and publishes the matching public key in DNS. It can't be generated by a checker — the key comes from Google Workspace's console — so this guide walks the console flow and the record you'll publish.

What you'll publish: One TXT record at google._domainkey.yourdomain.com (default selector: google). 2048-bit key recommended; 1024-bit only if your DNS host can't take a 2048-bit value.

Steps

1. Open the Admin console → Menu → Apps → Google Workspace → Gmail → Authenticate email.
2. Pick the domain under "Selected domain" and click Generate New Record (keep the default google selector and 2048-bit length).
3. Publish the shown value as a TXT record at google._domainkey on your domain.
4. Back in the Authenticate email screen, click Start authentication.

Gotchas

• ⚠A new Gmail domain must be active for 24–72 hours before a key can be generated.
• ⚠After publishing, signing can take up to 48 hours to start — and the Admin console may keep showing "You must update the DNS records" for up to 48 hours even when the record is correct.

Steps verified against Google: set up DKIM on 2026-07-17.