MailSlurp logo

guides

Google Workspace DKIM Setup: Generate the TXT Record, Turn It On, and Verify It

Set up Google Workspace DKIM without guessing. Learn how to generate the record in the Admin console, publish the TXT value, turn on signing, and verify real Gmail headers.

Use with your tools
View MarkdownAgent setupllms.txt

Published your Google Workspace DKIM record? There's one more switch to check: Google must also be told to start signing. Then a received message can show whether the signature passed and used the domain you expected.

Google's Admin guidance is clear on the high-level flow:

  1. open Gmail email authentication in the Admin console
  2. generate the DKIM record for the domain
  3. publish the TXT value in DNS
  4. turn on DKIM signing
  5. verify with a message header

Quick answer

For Google Workspace DKIM setup, the normal sequence is:

  1. wait until Gmail is fully enabled for the organization and domain
  2. generate a DKIM key and selector in the Admin console
  3. publish the selector TXT record, typically under a host like google._domainkey
  4. turn on signing in Google Workspace
  5. send a real message to someone else and confirm dkim=pass

Google documents a few details worth treating as release-critical:

  • after you enable Gmail for an organization, it can take 24-72 hours before the DKIM key is available
  • Google recommends a 2048-bit key when the domain provider supports it
  • after you start authentication, Google notes it can take up to 48 hours before outbound mail is signed consistently
  • Google explicitly says you cannot reliably verify setup by sending yourself a test message

If you skip those timing and verification details, you can end up diagnosing a "broken" setup that is really just incomplete or verified the wrong way.

What this guide covers

This page is for teams that need to answer:

  • where does Google Workspace generate the DKIM record?
  • what DNS host should be published?
  • when do we turn signing on?
  • how do we confirm Gmail is actually signing live mail?

If your issue is SMTP transport rather than DKIM signing, use Google Workspace SMTP relay instead.

Google Workspace DKIM vs generic DKIM setup

DKIM is a standard. Google Workspace is one implementation of it.

That matters because the generic DKIM concepts stay the same:

  • Google signs outbound mail with a private key
  • you publish the public key in DNS
  • the receiver verifies the signature with the published record

The Google-specific parts are:

  • where the selector and key are generated
  • when signing can be turned on
  • how the Google Admin console exposes the workflow
  • when Gmail starts signing mail for the configured domain

If you need the general model first, use What are DKIM records?.

The Google Workspace DKIM setup flow

At a practical level, the setup looks like this:

  1. confirm Gmail is active for the organization and the sending domain
  2. open Apps > Google Workspace > Gmail > Authenticate email
  3. select the domain
  4. generate the DKIM record
  5. choose a key length, with 2048-bit preferred when supported
  6. publish the TXT record in DNS
  7. return to the Admin console and start authentication
  8. verify with a real outbound message header

Google's interface often uses google as the selector name in examples, which leads to a host such as:

google._domainkey.example.com

That is not the only possible selector name, but it is a common default in Google Workspace guides and examples.

How to publish the DNS record correctly

When Google generates the record, pay attention to three things:

  • the exact selector host
  • the TXT value itself
  • whether your DNS provider expects the bare selector host or the fully qualified name

This is where many failures happen.

The Admin console can show a record that looks straightforward, but DNS UIs vary. Some want only google._domainkey. Others want the full hostname. Some wrap the TXT value automatically. Others do not.

That is why the safest sequence is:

  1. copy the generated record carefully
  2. publish it in DNS without editing the key material
  3. validate the selector with DKIM checker
  4. only then turn on signing

Do not "clean up" the TXT value manually unless you know exactly how the DNS provider expects long records to be entered.

What to verify after turning on signing

The DKIM record existing in DNS is not enough.

After you click to start authentication in Google Workspace, verify all of these:

  • the selector record resolves publicly
  • a live message shows a DKIM-Signature header
  • Authentication-Results reports dkim=pass
  • the signing domain aligns with the visible From domain

Google Workspace DKIM and DMARC

Google's bulk sender guidance for Gmail requires bulk senders to set up SPF, DKIM and DMARC. Review these together when checking your domain:

  • SPF pass and scope
  • DKIM pass
  • DMARC alignment
  • stable sender identity across tools and environments

If Google Workspace is one of several systems sending as your domain, check the DKIM signing domain and alignment for each system.

If you need the provider-specific policy and rollout side of that work, continue with Google Workspace DMARC.

Common Google Workspace DKIM mistakes

Turning on signing before the TXT record is publicly visible

This creates a noisy period where some messages may not verify as expected yet.

Verifying by sending mail to yourself

Google explicitly calls out that you should not rely on a self-sent test to verify DKIM setup. Use an external recipient or controlled test environment instead.

Publishing the wrong selector host

The record exists, but not under the selector Google Workspace is actually using.

Using a shorter key when a stronger one is available

Google recommends 2048-bit when the domain host supports it. If the provider does not support that key size cleanly, resolve that before rollout rather than quietly falling into a weaker or inconsistent setup.

Forgetting non-Google senders

Many teams set up Google Workspace DKIM correctly and still get DMARC failures because another system, such as support software, billing mail, or lifecycle automation, is sending from the same domain with a different signing and alignment path.

How to troubleshoot when Google Workspace DKIM still fails

Use this sequence:

  1. check the selector record with DKIM checker
  2. inspect a real message header with Email header analyzer
  3. confirm the selector in the header matches the published record
  4. confirm header.d= aligns to the intended domain
  5. validate DMARC with DMARC checker
  6. compare Google Workspace with any other sender using the same domain

This tells you whether the problem is:

  • missing DNS
  • wrong selector
  • signing not enabled
  • alignment failure
  • another platform using the same visible From domain

Google Workspace DKIM during migrations and domain changes

DKIM becomes especially important during:

  • domain cutovers
  • subdomain segmentation
  • ESP migrations
  • Google Workspace onboarding for a previously external sender

The mistake pattern is predictable:

  1. the domain changes
  2. Google Workspace DKIM is configured
  3. another sender keeps using the old path
  4. DMARC fails or delivery behavior becomes inconsistent

That is why DKIM verification should sit next to Google Workspace MX records, Google Workspace SMTP relay, and Return-Path in the same change review.

How MailSlurp helps

MailSlurp helps teams prove the real message path is healthy after DKIM setup.

Use MailSlurp to:

FAQ

How do I set up DKIM in Google Workspace?

Generate the record in the Google Admin console, publish the TXT value in DNS, then return to the Admin console to turn on signing and verify a live message header.

What selector does Google Workspace use?

Google often uses google as the selector in its common setup examples, which leads to a host like google._domainkey.example.com, but you should always confirm the actual selector shown in the Admin console for your domain.

How long does Google Workspace DKIM setup take?

Google documents that DKIM key availability can take 24-72 hours after Gmail is enabled for the organization, and up to 48 hours after starting authentication before signing is fully visible.

Should I test Google Workspace DKIM by emailing myself?

No. Google explicitly says not to rely on sending a test message to yourself to verify DKIM setup.

Does Google Workspace DKIM solve DMARC by itself?

No. Each sending system needs a passing SPF or DKIM result that aligns with its visible From domain.