Set Up DKIM on Google Workspace

This guide walks you through enabling DKIM signing for Google Workspace (formerly G Suite). DKIM adds a cryptographic signature to your emails, proving they came from your domain.

Step 1: Access Google Admin Console

1. Go to admin.google.com
2. Sign in with your admin account
3. Navigate to Apps → Google Workspace → Gmail
4. Click Authenticate email

Step 2: Generate DKIM Key

1. Select your domain from the list
2. Click Generate new record
3. Choose 2048-bit key length (recommended)
4. Leave the selector as google (default)
5. Click Generate

Step 3: Add DNS Record

Google will display the DKIM key. Add it to your DNS:

Name: google._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

# Note: The full key is much longer (around 400+ characters)
# Copy the exact value from the Google Admin Console

Step 4: Start Authentication

1. Wait 15-30 minutes for DNS propagation
2. Return to Google Admin Console
3. Click Start authentication
4. Google will verify the DNS record and enable DKIM signing

Step 5: Verify DKIM is Working

Send a test email and check the headers for dkim=pass:

# In Gmail: Open email → More → Show original
# Look for:
Authentication-Results: ...
  dkim=pass header.d=yourdomain.com header.s=google

Checklist

Next Steps

• Deploy DMARC
• Set up MTA-STS
• Test your configuration