Email provider
DKIM setup for Google Workspace
DKIM proves message integrity. Google Workspace gives you a selector and key or CNAME targets — publish them exactly.
Common mistake: Not turning DKIM on after publishing DNS — you must click Start authentication in Admin.
Step by step
Step 1 Google Admin console → Apps → Google Workspace → Gmail → Authenticate email (DKIM). SPF: no separate UI — publish TXT at your DNS host.
Step 2 Copy the exact hostnames and values Google Workspace shows — do not invent selectors. Typical pattern:
TXT at
google._domainkey — value from Admin → Authenticate email → Generate / show DNS record.Step 3 Add TXT or CNAME at the DNS provider that hosts your domain. Truncated keys fail verification.
Step 4 Query the record from an authoritative resolver or use propagation checker.
Step 5 Google Workspace / some hosts require clicking “enable” after DNS is green.
Step 6 Send a test message; check
DKIM-Signature and d=. Run DNS Preflight. Align with DMARC: /fix/dmarc/.DNS Preflight — verify SPF, DKIM, DMARC in one pass.
DMARC alignment — fixes when reports show failures.
FAQ
Where do I find Google Workspace DKIM records?
In the provider’s domain authentication / sender settings — copy live values.
CNAME vs TXT?
Use what the provider specifies — both are common.
Why dkim=fail?
Wrong selector, truncated key, or signing not enabled after publish.
Does this fix DMARC?
You need SPF + DKIM alignment for your From domain — DKIM is often the easier path for ESPs.
How to verify?
DNS Preflight for the published key; send test mail for header verification.