DKIM (DomainKeys Identified Mail) is an email authentication technology that helps receiving mail servers verify that an email claiming to come from your domain was actually authorized by your domain and was not improperly modified while being transmitted.

If your organization uses Google Workspace / Gmail with a custom business domain, configuring DKIM should be considered an essential part of your email infrastructure.

A properly configured business email domain should normally use three complementary authentication mechanisms:

• SPF – identifies servers/services authorized to send email for your domain.
• DKIM – cryptographically signs outgoing messages.
• DMARC – tells receiving systems how to handle authentication failures and provides domain alignment/reporting.

DKIM is therefore not simply a Gmail setting. It involves both:

1. Google Workspace Admin Console, where the DKIM signing key is generated and DKIM signing is activated.
2. Your domain's DNS provider, where the DKIM public key is published as a TXT record.

What Is DKIM?

DKIM stands for:

DomainKeys Identified Mail

When DKIM is enabled, the outgoing mail server creates a cryptographic signature and inserts it into the email header.

The receiving email server retrieves the corresponding public key from your domain's DNS records.

It then verifies the signature.

Conceptually:

Outgoing Email → Google Workspace → DKIM Signature Added → Recipient Mail Server → DNS Public Key Checked → Signature Verified

If verification succeeds, the recipient has evidence that:

• the message was authorized by the signing domain;
• the DKIM signature is valid;
• the signed portions of the message were not altered after signing.

DKIM therefore helps establish trust between your mail system and receiving mail servers.

Why Is DKIM Important for Google Workspace?

DKIM provides several important benefits.

1. Email Authentication

It allows receiving servers to verify that messages were signed by a server possessing the private DKIM key associated with your domain.

2. Domain Spoofing Protection

DKIM contributes to protection against attackers attempting to impersonate your domain.

DKIM alone does not completely prevent spoofing, which is why it should be combined with SPF and DMARC.

3. Better Email Deliverability

Proper authentication can improve the reputation and trustworthiness of legitimate email.

Messages without proper authentication have a greater chance of being rejected, quarantined, or classified as spam.

4. DMARC Compatibility

DMARC evaluates SPF and DKIM authentication together with domain alignment.

Therefore, properly configured DKIM is an important part of a complete DMARC deployment.

5. Compliance with Modern Sender Requirements

Major email providers increasingly expect organizations sending email to properly authenticate their domains.

This is especially important for organizations sending large volumes of email.

DKIM Components Explained

A DKIM configuration consists primarily of:

• Private key
• Public key
• Selector
• DNS TXT record
• DKIM signature

Private Key

The private key is used by the sending email system to create the DKIM signature.

When Google Workspace manages DKIM, Google handles the private signing key.

You should never manually publish a private key in DNS.

Public Key

The corresponding public key is published in DNS.

Receiving email servers retrieve this public key when validating messages.

DKIM Selector

A selector identifies which DKIM public key should be used.

Google commonly uses:

google

The resulting DNS host/name commonly resembles:

google._domainkey.example.com

Depending on your DNS provider, you may only need to enter:

google._domainkey

because the DNS management system automatically appends your domain.

Before Configuring DKIM

Make sure you have:

• Google Workspace administrator access
• Access to your domain's DNS management
• Gmail activated for the domain
• Correct MX records
• Ability to create TXT DNS records
• Knowledge of where your DNS is actually hosted

Your DNS provider might be:

• Hostinger
• Cloudflare
• GoDaddy
• Namecheap
• Squarespace
• cPanel hosting
• Your domain registrar
• Another DNS hosting company

Important: Your website hosting company and DNS provider are not necessarily the same company.

Always determine which authoritative DNS service manages the domain before adding the DKIM record.

Step 1 – Sign In to Google Admin Console

Sign in to the Google Admin Console using a Google Workspace administrator account.

Open:

Apps → Google Workspace → Gmail

Locate:

Authenticate Email

Google may change the exact wording or interface layout over time, but the setting is normally available within Gmail administration.

Step 2 – Select the Correct Domain

If your Google Workspace account contains multiple domains, make sure you select the domain for which DKIM needs to be configured.

For example:

example.com

Do not accidentally generate a DKIM record for a secondary domain when you intend to configure the primary domain.

Each sending domain should have appropriate email authentication configured.

Step 3 – Generate a New DKIM Record

Select the option to generate a new DKIM record.

Google will normally ask for parameters such as:

DKIM key bit length

and

Prefix selector

For the selector, the standard value is commonly:

google

You may therefore see a DKIM DNS hostname similar to:

google._domainkey.example.com

1024-bit vs 2048-bit DKIM – Which Should You Choose?

Google supports DKIM keys of different lengths.

Where supported by your DNS provider, the preferred choice is:

2048-bit

A 2048-bit key provides stronger cryptographic protection.

Use 1024-bit only when necessary because your DNS provider cannot properly support the longer DKIM TXT record or another technical compatibility issue requires it.

Therefore:

Recommended: 2048-bit
Compatibility option: 1024-bit

Do not downgrade to 1024-bit merely because an old tutorial recommends it.

Step 4 – Copy the DKIM DNS Information

After generating the record, Google provides information that must be published in DNS.

It will generally contain two important fields.

DNS Host / TXT Record Name

For example:

google._domainkey

TXT Record Value

The value typically begins with something similar to:

v=DKIM1; k=rsa; p=...

The p= section contains the DKIM public key.

The actual key will be considerably longer.

Never copy a DKIM key from an example article.

You must use the DKIM record generated specifically for your own Google Workspace domain.

Step 5 – Open Your Domain DNS Management

Sign in to the company that manages your domain's authoritative DNS.

Locate a section named something similar to:

• DNS
• DNS Zone
• DNS Zone Editor
• Manage DNS
• DNS Records
• Advanced DNS

Create a new record.

Step 6 – Create the DKIM TXT Record

Create:

Record Type: TXT

Name / Host:

google._domainkey

Value / Content:

Paste the complete DKIM value generated by Google.

It will resemble:

v=DKIM1; k=rsa; p=PUBLIC_KEY

Again, PUBLIC_KEY above is only an illustration.

Use the exact value provided by Google Workspace.

Important DNS Hostname Warning

Different DNS providers handle the hostname field differently.

Some expect:

google._domainkey

Others may display the fully qualified hostname:

google._domainkey.example.com

Do not accidentally create:

google._domainkey.example.com.example.com

This is a common DKIM configuration mistake.

Check how your DNS provider handles hostnames before saving the record.

Step 7 – Save the DNS Record

Save the TXT record.

The record must then propagate through DNS.

DNS changes are not always immediately visible everywhere.

Depending on the DNS provider, TTL, caching and DNS infrastructure, propagation may take some time.

Do not repeatedly delete and recreate the record simply because Google does not detect it immediately.

Step 8 – Verify the DKIM TXT Record in DNS

Before starting authentication, it is useful to verify that the DKIM public key is publicly available.

Query:

google._domainkey.yourdomain.com

as a TXT record.

You should receive a result beginning with something similar to:

v=DKIM1; k=rsa; p=

If no TXT record is returned, Google will not be able to successfully authenticate DKIM using that selector.

Step 9 – Return to Google Admin Console

After the TXT record has propagated, return to:

Google Admin Console → Apps → Google Workspace → Gmail → Authenticate Email

Select your domain.

Then click:

Start Authentication

Google Workspace can now begin DKIM signing for outgoing messages from the configured domain.

Step 10 – Confirm That DKIM Is Working

Do not assume DKIM is working simply because the DNS record exists.

Perform an actual email test.

Send an email from your Google Workspace account to another mailbox, such as a Gmail account.

Open the received email and inspect the original message headers.

In Gmail:

Open Message → Three-dot menu → Show original

Look for authentication results such as:

DKIM: PASS

You may also see:

SPF: PASS

and:

DMARC: PASS

A healthy configuration may therefore show:

SPF: PASS
DKIM: PASS
DMARC: PASS

Understanding the DKIM-Signature Header

A DKIM-signed message contains a header resembling:

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=google; ...

Important fields include:

v=

DKIM version.

a=

Cryptographic signing algorithm.

d=

Signing domain.

For your business email, this should normally correspond appropriately with your organization's sending domain.

s=

DKIM selector.

For a standard Google Workspace configuration this may be:

google

The recipient uses the selector and domain to locate the public key in DNS.

How DKIM Lookup Works

Suppose:

Domain:

example.com

Selector:

google

The receiving server looks for:

google._domainkey.example.com

It retrieves the TXT record containing the public key and uses that key to validate the message's DKIM signature.

This is why both components are essential:

Google Workspace configuration + DNS TXT record

Creating only one side does not complete the deployment.

DKIM vs SPF vs DMARC

These technologies work together but perform different functions.

Technology	Main Purpose
SPF	Identifies authorized sending infrastructure
DKIM	Cryptographically signs messages
DMARC	Applies domain alignment and authentication policy
DNS	Publishes the authentication records

A professional business domain should generally implement:

SPF + DKIM + DMARC

rather than relying on only one authentication mechanism.

Does DKIM Prevent Spam?

No.

DKIM does not determine whether the actual content of an email is spam.

It authenticates the signing domain and verifies the integrity of the signed message components.

A DKIM-signed email can still be spam.

Likewise, having DKIM configured does not guarantee Inbox placement.

Email providers consider many other factors, including:

• domain reputation
• IP reputation
• spam complaint rate
• recipient engagement
• message content
• sending volume
• sending patterns
• SPF
• DKIM
• DMARC
• DNS configuration
• unsubscribe practices
• historical reputation

DKIM is therefore an important component of deliverability—not a guarantee of deliverability.

Google Workspace DKIM and Third-Party Email Services

This is an especially important issue.

Your organization may use Google Workspace for normal employee email but also send email through:

• CRM systems
• ERP software
• accounting software
• website contact forms
• WordPress
• newsletters
• marketing platforms
• ticketing systems
• cloud applications
• SMTP services
• transactional email providers

Google Workspace DKIM only addresses messages signed through the applicable Google Workspace mail infrastructure.

Third-party services may require their own DKIM configuration.

For example, a marketing platform may ask you to create additional records such as:

selector1._domainkey.example.com

or:

selector2._domainkey.example.com

This is normal.

Multiple DKIM selectors can exist in DNS.

Never delete an existing DKIM record merely because another service asks you to create a new selector unless you fully understand the impact.

Common DKIM Problems and Solutions

Problem 1 – Google Says DKIM Record Is Not Found

Possible causes:

• DNS record has not propagated
• Wrong DNS provider was edited
• Wrong TXT hostname
• Incorrect selector
• TXT value copied incorrectly
• Domain automatically appended twice
• DNS caching

Solution

Query the exact TXT hostname:

google._domainkey.yourdomain.com

Confirm that the expected DKIM public key is publicly visible.

Problem 2 – DKIM Shows FAIL

Possible causes include:

• wrong public key in DNS
• incorrect selector
• old DKIM record
• malformed TXT record
• mail sent through another service
• message modified by an intermediary
• signing domain mismatch

Inspect the full email headers before changing the DNS configuration.

Problem 3 – DKIM Shows NONE

This normally means the received message did not contain the expected DKIM signature.

Check whether:

• DKIM authentication was actually started
• the message was sent through Google Workspace
• another SMTP server sent the email
• a third-party application bypassed Google

Problem 4 – TXT Record Is Too Long

2048-bit DKIM keys produce long DNS TXT values.

Most modern DNS providers support them correctly.

However, some older DNS interfaces or DNS systems may have limitations.

Do not manually shorten the DKIM public key.

If the provider cannot support the required record correctly, investigate its documentation or contact the DNS provider.

A 1024-bit key can be considered where 2048-bit records genuinely cannot be supported.

Problem 5 – Email Still Goes to Spam After DKIM Passes

DKIM authentication is only one signal.

Check:

• SPF
• DMARC
• domain reputation
• spam complaint rate
• mailing practices
• reverse DNS where applicable
• third-party sending services
• message content
• unsubscribe configuration
• sending volume and consistency

A DKIM=PASS result does not guarantee Inbox placement.

DKIM and DMARC Alignment

DMARC does more than simply check whether DKIM passed.

For DKIM to satisfy DMARC, the DKIM signing domain must appropriately align with the domain visible in the email's From: address.

For example:

From:

accounts@example.com

DKIM domain:

example.com

This provides appropriate organizational alignment in a normal configuration.

A DKIM signature can technically pass while still not satisfying DMARC alignment if the signing domain belongs to an unrelated domain.

This distinction becomes particularly important with third-party email platforms.

Should You Configure DKIM Before DMARC?

A practical deployment sequence is:

Step 1: Verify all legitimate email sending services.

Step 2: Configure SPF correctly.

Step 3: Configure DKIM for Google Workspace and other legitimate senders.

Step 4: Verify SPF and DKIM authentication.

Step 5: Configure DMARC.

Step 6: Monitor DMARC reports.

Step 7: Gradually strengthen the DMARC policy when appropriate.

This reduces the risk of accidentally blocking legitimate business email.

DKIM Security Best Practices

For a professional Google Workspace deployment:

1. Prefer 2048-bit DKIM where supported.
2. Never publish or expose private DKIM signing keys.
3. Verify DNS records after making changes.
4. Configure SPF as well as DKIM.
5. Deploy DMARC after verifying legitimate senders.
6. Identify every third-party system sending email for your domain.
7. Configure separate DKIM authentication for third-party senders where supported.
8. Periodically inspect authentication results.
9. Monitor email reputation and authentication performance.
10. Review DNS records whenever changing email providers.
11. Remove obsolete DKIM selectors only after confirming they are no longer used.
12. Avoid copying authentication records from another domain.
13. Keep DNS administrative accounts secured with strong authentication.
14. Document which selector belongs to which email service.
15. Test authentication after major email-routing changes.

Recommended Email Authentication Architecture

For organizations using Google Workspace, the desired architecture is generally:

Business Domain

↓

SPF

Authorizes legitimate sending systems

↓

DKIM

Cryptographically authenticates messages

↓

DMARC

Evaluates SPF/DKIM alignment and establishes policy

↓

Receiving Email Server

↓

Authentication + Reputation + Spam Evaluation

↓

Inbox / Spam / Quarantine / Reject

This layered approach is much stronger than relying on a single DNS record.

Google Workspace Bulk Sender Considerations

Organizations sending large quantities of email should pay particular attention to authentication.

High-volume senders to Gmail accounts are expected to use stronger authentication practices, including SPF, DKIM and DMARC.

Organizations should therefore avoid thinking of DKIM as an optional configuration that only large enterprises need.

Even small businesses benefit from properly authenticating their domains.

How to Check DKIM After Configuration

There are several useful methods.

Method 1 – Gmail Show Original

Send a test email to Gmail.

Open:

Three-dot menu → Show original

Confirm:

DKIM: PASS

Method 2 – DNS Lookup

Check the TXT record:

google._domainkey.yourdomain.com

Method 3 – Google Admin Tools

Google's administrative diagnostic tools can be used to inspect DNS and email-related records.

Method 4 – Email Header Analysis

Inspect:

• Authentication-Results
• DKIM-Signature
• Received-SPF
• DMARC results

Header analysis is particularly useful when troubleshooting complex mail routing.

Example of a Healthy Authentication Result

A properly configured message might produce authentication results conceptually similar to:

spf=pass

dkim=pass

dmarc=pass

This is a strong indication that the major email authentication mechanisms are operating correctly for that message.

Important Warning When Changing Existing DKIM Keys

If DKIM is already working, do not generate a new key casually.

Generating/replacing DKIM configuration can temporarily affect authentication if the corresponding DNS record is not correctly published and authentication is not restarted with the new configuration.

Before rotating a working DKIM key:

• document the existing configuration;
• understand the effect of generating the replacement;
• publish the correct DNS information;
• allow DNS propagation;
• activate authentication correctly;
• send test messages;
• confirm DKIM=PASS.

DKIM key rotation should be treated as a controlled email infrastructure change.

DKIM Configuration Checklist

Before considering the implementation complete, confirm:

• Google Workspace Gmail is active
• Correct domain selected
• DKIM key generated
• 2048-bit key selected where supported
• Correct selector configured
• DKIM TXT record added to authoritative DNS
• TXT value copied completely
• DNS hostname is correct
• DNS record publicly resolves
• Start Authentication completed
• Test email sent
• DKIM result shows PASS
• SPF checked
• DMARC checked/configured
• Third-party email services identified
• Third-party DKIM configured where necessary
• Authentication monitored periodically

Frequently Asked Questions (FAQ)

1. What is DKIM in Google Workspace?

DKIM is an email authentication mechanism that allows Google Workspace to cryptographically sign outgoing messages from your domain so receiving servers can verify them using a public key stored in DNS.

2. Is DKIM mandatory for Google Workspace?

A domain may technically send mail without administrator-configured custom-domain DKIM in some situations, but proper email authentication is strongly recommended and increasingly important for reliable business email delivery.

3. Does Google Workspace automatically configure my DNS DKIM record?

No. Google generates the DKIM information, but you normally need to publish the provided TXT record at the DNS provider that hosts your domain's authoritative DNS.

4. What is the default Google DKIM selector?

A commonly used selector is:

google

which results in a DNS hostname such as:

google._domainkey.example.com

5. Should I use 1024-bit or 2048-bit DKIM?

Use 2048-bit when your DNS provider supports it. It provides stronger cryptographic protection. Use 1024-bit where compatibility limitations genuinely require it.

6. What type of DNS record does Google DKIM use?

Google Workspace DKIM normally uses a:

TXT record

7. How long does DKIM DNS propagation take?

It depends on the DNS provider, TTL values and caching. Changes may appear quickly but can sometimes take considerably longer to propagate.

8. Can I configure DKIM without DNS access?

No. You need access to the authoritative DNS or assistance from the administrator/provider that manages it.

9. Does DKIM stop domain spoofing completely?

No. For stronger protection, DKIM should be combined with SPF and DMARC.

10. Does DKIM improve email deliverability?

Correct authentication can improve trust and deliverability, but DKIM does not guarantee Inbox placement.

11. Can SPF pass while DKIM fails?

Yes. SPF and DKIM are independent authentication mechanisms.

12. Can DKIM pass while SPF fails?

Yes.

13. Can DKIM pass while DMARC fails?

Yes. For example, DKIM may technically validate but not align appropriately with the visible From domain.

14. Do I need DKIM if SPF is already configured?

Yes. Modern business email authentication should normally use SPF and DKIM together, with DMARC layered on top.

15. Can multiple DKIM records exist for one domain?

Yes. Different selectors can be used by different email platforms.

16. Does my website need DKIM?

DKIM applies to email, not the website itself. However, if your website sends mail using your business domain, the sending service should be properly authenticated.

17. What happens if I delete the DKIM DNS record?

Messages signed using that selector may fail DKIM verification because receiving servers will no longer be able to retrieve the required public key.

18. Why does Google say “Authentication failed” or that the record cannot be verified?

Usually because the TXT record is missing, incorrect, not yet propagated, or was added under the wrong hostname/DNS provider.

19. Can DKIM records be added in Cloudflare?

Yes, if Cloudflare is managing the authoritative DNS for the domain.

20. Can DKIM be configured in Hostinger?

Yes, if the domain's authoritative DNS is managed through Hostinger.

21. Can a third-party SMTP service use Google's DKIM record?

Normally, third-party sending platforms use their own DKIM keys and selectors. Follow the provider's domain authentication instructions.

22. Does DKIM encrypt email?

No. DKIM provides authentication and integrity verification. It does not encrypt the message body for confidentiality.

23. Does DKIM protect incoming email?

DKIM allows receiving systems to verify signed incoming messages. Your own DKIM configuration primarily controls signing of your organization's outgoing mail.

24. How do I know DKIM is definitely working?

Send an actual test message and inspect its authentication results. Look for:

DKIM: PASS

25. Should small businesses configure DKIM?

Yes. Proper email authentication is valuable for businesses of all sizes, particularly when using a custom company domain.

Conclusion

DKIM is one of the most important email authentication technologies for organizations using Google Workspace.

The basic deployment process is:

Generate DKIM key in Google Workspace → Publish TXT record in DNS → Wait for DNS propagation → Start Authentication → Send test email → Verify DKIM PASS

However, DKIM should not be deployed in isolation.

For a properly secured business email environment, configure and maintain:

SPF + DKIM + DMARC

and ensure that every legitimate third-party service sending email for your domain is also correctly authenticated.

Regularly checking these records and reviewing actual email authentication results can significantly reduce configuration errors and help maintain reliable business email delivery.

 

#GoogleWorkspace #DKIM #GoogleDKIM #DKIMSetup #GmailDKIM #EmailAuthentication #EmailSecurity #GoogleWorkspaceSecurity #GoogleAdmin #GoogleAdminConsole #GmailSecurity #DNS #DNSRecords #TXTRecord #DomainKeys #DomainKey #EmailDeliverability #GmailDeliverability #SPF #DMARC #SPFDKIMDMARC #EmailProtection #DomainSecurity #BusinessEmail #BusinessEmailSecurity #GoogleWorkspaceAdmin #WorkspaceAdmin #GmailAdmin #DKIMAuthentication #DKIMVerification #DKIMTroubleshooting #EmailSpoofing #AntiSpoofing #DomainSpoofing #EmailDNS #GoogleWorkspaceGuide #GmailGuide #EmailAdministrator #ITAdministrator #SysAdmin #EmailInfrastructure #EmailReputation #GooglePostmaster #DMARCAlignment #DKIMSignature #DNSManagement #CorporateEmail #WorkspaceSecurity #EmailBestPractices #BISONKB