In order you can setup DKIM in Google Workspace to authenticate your messages with DKIM, you need to ensure that the following conditions are met:
- Admin access to Google Workspace. To configure DKIM settings, you need to be able to login as administrator in your Google Workspace account.
- Domain DNS access. You’ll need to publish TXT records for DKIM in your domain’s DNS management panel, so having access to it is necessary.
- Domain ownership. You’ll need to ensure that the domain you are setting up DKIM for is yours. The authenticity of the emails you will be sending from the domain depends on this.
- Domain configuration. Your domain must be set up correctly and must be operational in your Google Workspace account.
How to Setup DKIM in Google Workspace
In order to sign outbound emails by your custom domain and pass DKIM alignment, follow this detailed guide to enable DKIM in Google Workspace:
Step 1: Create a DKIM Key.
Login as administrator in your Google Workspace Admin console and navigate to Menu > Apps > Google Workspace > Gmail.
Click “Authenticate email.”
Select the domain, for which you want to configure DKIM signing, in the “Selected domain” menu.
Click “Generate New Record”.
In the “Generate new record” box, select your DKIM key settings:
2048 – if your domain provider supports 2048-bit keys, select this option. Longer keys are more secure than shorter keys.
1024 – if your domain host doesn’t support 2048-bit keys, select this option.
Choose the prefix selector. The default prefix selector is google. If your domain already uses a DKIM record with the ‘google’ prefix, enter a different prefix in this field.
Next, click “Generate.”
The message “DKIM authentication settings updated” will appear.
Copy the values in the “Authenticate email” window and update the DNS records for this domain.
Step 2: Add DKIM Key to DNS.
Login to your hosting provider’s account.
Select the domain and go to the settings where you update TXT records for your domain. Typically it’s called “DNS settings”, “DNS management” or something similar.
Click on the “Add record” button.
Add the TXT record with this information:
Type: TXT
Host (Hostname, Alias): the domain name. If the Host is the same domain (not subdomain) you are adding the TXT record to, enter the @ symbol.
Value: the generated DKIM key
Save the changes.
If you are setting up DKIM for a subdomain, refer to your domain provider’s documentation to properly add a DKIM TXT record for the subdomain.
If you are setting up DKIM for more than one domain, get a unique DKIM key from the Google Workspace Admin Console for each domain and complete these steps.
After adding a DKIM TXT record, it can take up to 48 hours for DKIM authentication to start working.
Step 3: Turn on DKIM Signing in Google Workspace.
Now you need to turn on DKIM signing for outbound emails in your Google Admin console.
In the Admin console, navigate to Menu > Apps > Google Workspace > Gmail.
Click “Authenticate email”.
Select the domain, for which you added a DKIM key.
Click “Start authentication.”
If the DKIM setup is done correctly, the status at the top of the page changes to: Authenticating email with DKIM.