Google Workspace DKIM setup for DMARC alignment

Google Workspace can sign outgoing mail with DKIM for your custom domain. Some partner-managed domains have DKIM configured during setup. Check the current state before adding a new key.

Without custom-domain DKIM, DMARC has to rely more heavily on SPF alignment. That is fragile when messages are forwarded or when other senders use your domain. DKIM gives Gmail a cryptographic signature tied to your domain.

Google’s DKIM setup documentation says you generate a unique key for each domain in the Admin console, add the public key to DNS, then start authentication. We verified these steps in August 2026.

In report data, we see two Google Workspace mistakes repeatedly. The TXT key exists but Start authentication was never selected. Or Gmail signs correctly, but a separate marketing or support sender still uses an unaligned domain.

Before you start

You need:

• Google Workspace super administrator access.
• DNS access for the domain you send from.
• Gmail already activated for your organization.
• A verified custom domain in Google Workspace.

Google says you may need to wait 24 to 72 hours after turning on Gmail before you can generate the DKIM key in the Admin console.

Step 1: open Google Workspace DKIM settings

Sign in to the Google Admin console with a super administrator account.

Go to Apps > Google Workspace > Gmail > Authenticate email.

Select the domain you want to authenticate. If you manage multiple domains or aliases, repeat the process for each domain that sends mail.

Step 2: generate the DKIM record

Click Generate New Record.

Use a 2048-bit key if your DNS provider supports it. Google recommends 2048-bit keys. Use 1024-bit only when the DNS provider cannot store the longer value.

For the selector, Google’s recommended default is:

google

That creates a DNS host name like:

google._domainkey

The value is a long TXT record that begins with v=DKIM1; k=rsa; p=.... Copy the exact value from Google. Do not shorten it.

Step 3: add the DKIM TXT record in DNS

At your DNS provider, create the record Google shows:

Field	Value
Type	TXT
Host / Name	google._domainkey
Value	The full TXT value from Google
TTL	Default

Some DNS providers automatically append your domain. If your domain is example.com, entering google._domainkey should create google._domainkey.example.com. Do not accidentally create google._domainkey.example.com.example.com.

If the DNS provider splits long TXT values, use its normal TXT splitting behavior. Do not add extra spaces or smart quotes.

Step 4: turn on DKIM in Google

Return to Authenticate email in the Google Admin console.

After DNS has propagated, click Start Authentication. Google may continue showing a DNS warning for up to 48 hours, so verify the public DNS record if the interface is slow to update.

Once enabled, Google Workspace signs outgoing Gmail messages with your domain in the DKIM d= value.

Step 5: verify DKIM and DMARC alignment

Before sending anything, confirm the key is actually published. Run the domain through our DKIM checker: it probes google._domainkey for you and decodes the key it finds, so a doubled hostname or a half-saved TXT record shows up as a missing key rather than as a mystery two days later.

Then send a test email from Google Workspace to a Gmail account. Open the message details and confirm DKIM passes.

Finally check the domain with DMARCTrust’s domain checker. You are looking for:

• A valid SPF record.
• Google Workspace DKIM passing on real mail.
• A DMARC record at _dmarc.
• DMARC reports flowing to a monitored address.

DKIM passing is not always the same as DMARC passing. For DMARC, the DKIM signing domain must align with the visible From domain. With Google Workspace custom-domain DKIM, it normally does.

Common mistakes

Publishing the record but not starting authentication. DNS alone is not enough. You must enable signing in Google.

Using the wrong selector. If Google generated google._domainkey, do not publish selector1._domainkey or a copied value from another provider.

Editing the TXT value. DKIM keys are exact. Formatting changes can invalidate the public key.

Forgetting outbound gateways. If an outbound gateway modifies message bodies or footers after Google signs the message, DKIM can fail.

What about SPF and DMARC?

Set up the Google Workspace SPF record too:

v=spf1 include:_spf.google.com ~all

Then publish DMARC in monitoring mode:

v=DMARC1; p=none; rua=mailto:[email protected];

Use the DMARC generator to create the value and DMARCTrust to parse the reports. Move toward enforcement only after the reports account for every legitimate sender.

FAQ

What is the DKIM selector for Google Workspace?

The default selector is google, so the DNS host is usually google._domainkey.

Should I use 1024-bit or 2048-bit DKIM?

Use 2048-bit unless your DNS provider cannot publish the longer TXT value.

Does Google Workspace DKIM replace SPF?

No. Use both SPF and DKIM. DMARC can pass if either SPF or DKIM passes with alignment, but DKIM is usually more resilient.