How to Set Up DKIM for Google Workspace (G Suite)

DKIM is a digital signature on your outgoing email. Receiving servers check it against a public key published in your DNS. Google Workspace (formerly G Suite) does not turn DKIM on by default for your domain, so you have to generate a key and publish it yourself.

Before you start

You need admin access to the Google Workspace admin console and access to your DNS host (GoDaddy, Cloudflare, Namecheap, etc.).

Step 1: Generate the key

You must be a super administrator, with the Gmail Settings administrator privilege.

1. Sign in to the Google Admin console.
2. Go to Menu > Apps > Google Workspace > Gmail, then open the DKIM setup section.
3. Click Generate.

Google then shows two values: a DNS Host name (the TXT record name) and a TXT record value (the key).

Wait period: after Gmail is turned on for your organization, you must wait 24 to 72 hours before the key can be generated. If you try sooner, you may see an error that the DKIM record was not created.

Step 2: Publish the TXT record

At your DNS host, add a new record:

• Type: TXT
• Host / Name: the DNS Host name Google shows you (the usual form is google._domainkey, but use exactly what the console displays)
• Value: the long string starting with v=DKIM1; k=rsa; p=... that Google gave you

Some DNS panels add your domain to the name automatically. If you see the name doubled (for example google._domainkey.yourdomain.com.yourdomain.com), enter only google._domainkey.

Step 3: Turn on and verify DKIM

Return to the Google Admin console and turn on DKIM for the domain. Google checks the DNS record. DNS changes can take a few minutes to a day to show up, so if the check fails, wait and try again.

Step 4: Confirm it works

Send a test email from your Workspace account to a Gmail address. Open the message, choose Show original, and look for dkim=pass in the authentication results. The header.d= value should be your domain.

You can also check the record from a terminal:

dig +short TXT google._domainkey.yourdomain.com

It should return a value starting with v=DKIM1.

Common problems

• The check fails right after you add the record. DNS is still propagating. Wait and retry.
• The record shows but mail still says dkim=none. DKIM was never turned on for the domain. Return to the admin console and turn it on.
• You regenerated the key. The old TXT record must be replaced with the new value, or signatures will fail.

Once DKIM passes, you can add a DMARC policy. See our DMARC guide for the next step.