Fix guide

How to Fix DMARC Alignment for Google Workspace

Google Workspace automatically handles DMARC alignment when DKIM is enabled in Google Admin. The most common failure is DKIM not being turned on — Google signs email with a temporary key until you generate and publish your own 2048-bit DKIM key.

Why alignment fails

Google Workspace uses a default DKIM key (google._domainkey) that is automatically published. However, if you haven't generated a custom key in Google Admin, alignment may use a weaker default or fail entirely. See DMARC and DKIM in the glossary.

Exact DNS record

After generating keys in Admin, publish:

google._domainkey.yourdomain.com → TXT → "v=DKIM1; k=rsa; p=[your-public-key]" (Key generated in Google Admin)

Step-by-step fix

Step 1 Google Admin → Apps → Gmail → Authenticate email
Step 2 Select your domain and click Generate new record
Step 3 Choose 2048-bit key length
Step 4 Copy the TXT record value and add it to your DNS at google._domainkey.yourdomain.com
Step 5 Return to Google Admin and click Start authentication
Step 6 Run DNS Preflight to confirm DKIM pass and alignment

Verify alignment and DNS in your browser

Open DNS Preflight →
Related glossary: DMARC · DMARC alignment · DKIM · SPF record

FAQ

Does Google Workspace automatically set up DMARC alignment?

DKIM alignment is automatic once you generate and publish your DKIM key in Google Admin. SPF alignment works automatically if you include:_spf.google.com in your SPF record.

What DKIM key size should I use for Google Workspace?

Always choose 2048-bit. 1024-bit keys are considered weak and Google now recommends against them.

My Google Workspace DKIM shows as pass but DMARC still fails — why?

Check DMARC alignment specifically — DKIM pass alone is not enough. The d= tag in the DKIM signature must match your From: domain. Run DNS Preflight to check alignment directly.

How long does Google Workspace DKIM take to activate?

DNS propagation takes up to 48 hours. Google Admin will show "Authenticating" until the record is verified.

Do I need to set up SPF separately for Google Workspace?

Yes. Add include:_spf.google.com to your SPF TXT record. This allows Google's servers to pass SPF checks independently of DKIM.

← All DMARC fix guides

Run checks on domainpreflight.dev →