FindLeadEmails
Email intelligence
Try it for free
Mail host · DKIM

DKIM record for Google Workspace

How to add a DKIM record when DNS or mail is at Google Workspace. Real steps, then a live lookup.

Google hosts the mailboxes. DNS still lives at your registrar or Cloudflare.

  1. In Google Admin, go to Apps > Google Workspace > Gmail > Authenticate email.
  2. Generate a new DKIM key. Google will give you a selector (usually google) and a TXT value.
  3. Publish it at google._domainkey.yourdomain.com (or the selector they showed).
  4. Return to Admin and start authentication. It can take up to 48 hours to flip to authenticating.

Official docs: Google Workspace. Other records for this provider: SPF · DKIM · DMARC

Does this page apply to you?

Run this first. Google Workspace only matters if it is where your DNS or mail actually lives.

dig +short MX yourdomain.com

Expect: Hostnames ending in google.com, such as smtp.google.com or aspmx.l.google.com. If they point elsewhere, mail is not hosted at Google.

Specific to Google Workspace

  • Generate the key in Google Admin under Apps, Google Workspace, Gmail, Authenticate email. Choose 2048-bit unless your DNS host cannot store the longer value.
  • The default selector is google, so the record name is google._domainkey. If you chose a different selector in Admin, use that one.
  • Publishing is not the last step. After the record has propagated, return to Admin and click Start authentication. Until you do, Gmail signs with a Google-owned domain, which does not help DMARC alignment.

What you should end up with

Illustrative values. Use the exact host and value your provider shows you where it generates them.

Type  Name  Value
TXT  google._domainkey  v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A… (Google generates the full key)

What the receiving server does with this record

Your sending server signs each message with a private key and adds a DKIM-Signature header naming the signing domain (d=) and the selector (s=). The receiver builds the hostname s._domainkey.d, fetches the public key from DNS, and verifies the signature. A valid signature proves the message came from that domain and was not changed on the way.

Mistakes that break it

  • Published, but signing never switched on. Most providers need a second step after the DNS record exists. Until then they sign with their own domain, which passes DKIM but does not align with your From address, so it does nothing for DMARC.
  • A doubled hostname. Typing the full name into a field that already appends your domain gives selector._domainkey.yourdomain.com.yourdomain.com.
  • A damaged key. A 2048-bit key is longer than one 255-character DNS string. Stray spaces, line breaks and silent truncation all invalidate it.
  • The wrong selector. The record is published under one name and the sender signs with another.

Check it from the command line

The final test is a real message: send one to a Gmail address, open Show original, and read the DKIM line. Before that, confirm the record resolves:

dig +short TXT google._domainkey.yourdomain.com

Check it live

Check the DKIM record

Look up the live DNS after you save. This tool does not spend credits.

Related