# Why is Google Workspace DKIM not authenticating, and how do you fix it?

URL: https://iblockspam.com/blog/google-workspace-dkim-not-authenticating
Last updated: 2026-10-22
Published: 2026-10-22
Topic: SPF, DKIM & DMARC
Author: iBlockSpam Team

> Fix Google Workspace DKIM stuck on Not authenticating: the exact Admin console messages, causes from a missing TXT record to a split 2048-bit key, and checks.

## Short answer

Google Workspace DKIM shows Not authenticating when setup isn't finished. Usually the TXT record at google._domainkey is missing, misnamed or truncated, or Start authentication was never clicked. Check the record with a DNS lookup, fix the host name or split a 2048-bit key into quoted strings, wait for DNS, then click Start authentication under Gmail > Authenticate email.

You generated a DKIM key in Google Workspace, published it, and the Admin console still says the domain isn't authenticating. Or the console looks fine but receivers report `dkim=fail`. This guide starts from the exact message you're seeing, lists the causes in order of how often they happen, and gives the fix for each.

If you're setting DKIM up for the first time, start with our [DKIM setup guide for Microsoft 365 and Google Workspace](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace) and come back here if it doesn't work.

## What does "Not authenticating" mean in Google Workspace?

"Not authenticating" means Gmail isn't signing your domain's outgoing mail with your DKIM key yet. Google's troubleshooting page says that if you see this "after you create a DKIM record and add it to your domain, you need to complete your setup": open **Authenticate email** and click **Start authentication** ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/troubleshoot-dkim-issues)).

DKIM (DomainKeys Identified Mail) signs each message with a private key. Receivers fetch the matching public key from a DNS TXT record named `<selector>._domainkey.<your domain>`. In Google Workspace, the default selector is `google`.

When it works, Google says the status at the top of the page changes to "Authenticating email with DKIM."

## Which message are you seeing?

| Message or symptom (examples) | Where | What it usually means | Go to |
|---|---|---|---|
| "Not authenticating" | Authenticate email page | Start authentication not clicked, or the record isn't found | Causes 1–3 |
| "You must update the DNS records for this domain" | Authenticate email page | Normal for up to 48 hours after generating a key | Cause 4 |
| An error "that the DKIM record was not created" | When generating a key | Gmail was turned on less than 24–72 hours ago | Cause 5 |
| Blank DNS host name and TXT record value | Authenticate email page | No key has been generated for this domain | Cause 6 |
| No DKIM line in `Authentication-Results` | Received message headers | Mail isn't being signed | Causes 1–6 |
| `dkim=fail` with "body hash did not verify" | Received message headers | The message changed after signing | Cause 8 |
| `dkim=pass` but `dmarc=fail` | Received message headers | The passing signature isn't for your From domain | Cause 10 |

The Admin console messages are quoted from Google's [Set up DKIM](https://knowledge.workspace.google.com/admin/security/set-up-dkim) and troubleshooting pages.

## What are the most common causes, and how do you fix them?

### 1. Start authentication was never clicked

Google's own instructions say not to click **Start authentication** until the TXT record is published, so it's easy to forget. Fix: go to **Menu** > **Apps** > **Google Workspace** > **Gmail** > **Authenticate email**, select the domain in **Selected domain**, and click **Start authentication**. You need the **Gmail Settings** administrator privilege.

### 2. The TXT record has the wrong host name

The record must sit at exactly `google._domainkey.example.com` (with your domain and selector). The usual mistake is a doubled domain. Many DNS hosts append your domain to whatever you type, so entering `google._domainkey.example.com` creates `google._domainkey.example.com.example.com`. Fix: enter only `google._domainkey` in the host field if your provider appends the domain. Our [GoDaddy](https://iblockspam.com/blog/add-email-dns-records-godaddy) and [Namecheap](https://iblockspam.com/blog/add-email-dns-records-namecheap) guides show how two common hosts behave.

### 3. The key was truncated or split wrongly

A 2048-bit key is longer than 255 characters, the size of one string in a TXT record. Google says you "can not enter a 2048-bit key as a single text string with a 255-character TXT record limit," and that the key "might be truncated" or its parts "sent out of order." Fix: split the value into several quoted strings in the same record, one after another:

```
google._domainkey  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...first-part" "...second-part...IDAQAB"
```

[RFC 6376, section 3.6.2.2](https://www.rfc-editor.org/rfc/rfc6376.html) says receivers concatenate the strings "with no intervening whitespace," so a stray space inside a string breaks the key. If your host can't store long TXT values at all, Google suggests a 1024-bit key or asking the host. Our guide to [2048-bit DKIM keys that are too long](https://iblockspam.com/blog/dkim-2048-bit-key-txt-record-too-long) covers splitting in detail.

### 4. DNS hasn't caught up yet

Google says it "can take up to 48 hours for DKIM authentication to start working" after you add the key, and the "You must update the DNS records" message can persist for up to 48 hours. If a lookup already returns the right value, you can ignore that message. Wait, then retry **Start authentication**.

### 5. You generated the key too soon

Google says you must wait "24–72 hours" after turning on Gmail before you can get a DKIM key, or you might get an error "that the DKIM record was not created." Fix: wait and generate again.

### 6. The key belongs to a different domain

Google says you must get "a unique DKIM key from the Admin Console for each domain." A secondary domain needs its own key, published at its own DNS host. Fix: check **Selected domain** before you generate, publish and start. One exception: Google says that if your domain provider is Squarespace, "the DKIM key is automatically created and added to your domain's DNS records," so you skip straight to turning it on. Our [Squarespace DNS guide](https://iblockspam.com/blog/add-email-dns-records-squarespace) covers that host.

### 7. Two records exist for the same selector

RFC 6376 says TXT records "MUST be unique for a particular selector name"; with several, "the results are undefined." An old key left at `google._domainkey` beside the new one is a common culprit. Fix: keep one record per selector. If another service already uses the `google` prefix, Google says to enter a different prefix when generating.

### 8. Something changes the message after Gmail signs it

Google says a `body hash did not verify` result means "the message was modified during transit," and warns that outbound gateways adding a footer can cause it. Forwarders and mailing lists do the same. Fix: stop the gateway from modifying signed mail, or have it sign after it changes the message. Our guide to [DKIM body hash failures](https://iblockspam.com/blog/dkim-fail-body-hash-did-not-verify) covers the other causes.

### 9. Too many signatures

Google says Gmail "checks only the first 5 signatures" in a message, in order. If your domain's signature comes later, DKIM fails. This mostly affects mail passed through several signing services.

### 10. DKIM passes, but not for your domain

DMARC ([RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html)) only counts a DKIM pass for a domain aligned with the From address. If `header.d=` shows another domain, DMARC doesn't benefit. Fix: finish setup under **Authenticate email**, and give each third-party sender its own key for your domain. See [DMARC alignment: relaxed vs strict](https://iblockspam.com/blog/dmarc-alignment-relaxed-vs-strict).

## How do you check that DKIM is published and passing?

1. **Compare DNS with the console.** Copy the TXT value from **Authenticate email**, then look up your selector with the [DKIM Checker](https://iblockspam.com/tools/dkim-checker) or a command such as `dig +short TXT google._domainkey.example.com`. Google suggests the Admin Toolbox Dig tool for the same check. Every character must match, in order.
2. **Send a real test.** Google says you "can't verify DKIM is on by sending yourself a test message." Send to an outside Gmail or Workspace user instead.
3. **Read the header.** In Gmail, choose **More** > **Show original** and find `Authentication-Results`. You want something like (illustrative):

   ```
   dkim=pass header.i=@example.com header.s=google header.b=Abc123de;
   ```

4. **Interpret anything else.** [RFC 8601, section 2.7.1](https://www.rfc-editor.org/rfc/rfc8601.html) defines the results:

| Result | Meaning |
|---|---|
| `none` | The message wasn't signed |
| `pass` | The signature verified |
| `fail` | The signature was checked and failed |
| `neutral` | The signature had syntax errors or couldn't be processed |
| `policy` | Signed, but some aspect of the signature wasn't acceptable to the receiver |
| `temperror` | A temporary problem, such as failing to fetch the key; retry later |
| `permerror` | An unrecoverable error, such as a missing required header |

The [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) reads these lines for you, in your browser.

## Why does it matter if Google Workspace DKIM isn't working?

Without your own DKIM signature, your mail has one less way to pass DMARC, and receivers have less reason to trust it. Google's setup page recommends SPF and DMARC alongside DKIM and says "bulk senders are required to set up DKIM, SPF, and DMARC" under its email sender guidelines ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/set-up-dkim)). Our summary of [Gmail, Yahoo and Microsoft bulk sender requirements](https://iblockspam.com/blog/gmail-yahoo-microsoft-bulk-sender-requirements) lists what each provider expects.

DKIM also matters most when SPF can't help. Forwarded mail usually fails SPF because it arrives from the forwarder's server, while an intact DKIM signature survives. A domain that relies on SPF alone loses DMARC on every forwarded message.

## What should you check if it still fails?

- The value starts with `v=DKIM1;` and the `p=` key has no line breaks or spaces inside strings.
- Some DNS hosts want the whole value in quotes; others add quotes themselves. Check how yours shows a saved record.
- Google recommends no more than 49 TXT records at your provider, "the maximum number supported by most domain providers."
- If you run your own mail server rather than Gmail for some mail, it needs its own key; the [DKIM Key Generator](https://iblockspam.com/tools/dkim-generator) can create one. Don't use it for Google Workspace, which generates its own.

## Next steps

- Look up `google._domainkey` for every domain you send from and confirm each returns a full key.
- Click **Start authentication** for any domain still showing Not authenticating.
- Check your DMARC record with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) once DKIM passes, then plan enforcement.
- iBlockSpam's [free domain monitoring](https://iblockspam.com/free-monitoring) watches your public MX, SPF, DMARC and MTA-STS records and emails you when they change.

Browse our other [SPF, DKIM and DMARC guides](https://iblockspam.com/blog/topic/authentication).

## Frequently asked questions

### What does Not authenticating mean on the Google Workspace DKIM page?

Google says a Not authenticating status after you've created a DKIM record and added it to DNS means setup isn't complete. Go to Apps > Google Workspace > Gmail > Authenticate email, select the domain and click Start authentication. If that fails, the TXT record Google expects can't be found or doesn't match.

### Can I ignore the You must update the DNS records for this domain message?

Yes, if the record is right. Google says the Authenticate email page can keep showing that message for up to 48 hours after you generate a key. If a DNS lookup of google._domainkey at your domain returns the same value as the Admin console, wait and then click Start authentication.

### Why can't I generate a DKIM key in a new Google Workspace account?

Google says you must wait 24 to 72 hours after turning on Gmail for your organization before you can get your DKIM key. If you try sooner, you might see an error that the DKIM record was not created. Wait, then generate the key again under Authenticate email.

### Does each Google Workspace domain need its own DKIM key?

Yes. Google says you must get a unique DKIM key from the Admin console for each domain, and repeat the setup for each one. Select the right domain in the Selected domain menu before generating, publish its TXT record at that domain's DNS host, then start authentication for that domain.

### Why does DKIM pass but DMARC still fail for my Google Workspace mail?

DMARC needs a DKIM pass for a domain that aligns with the visible From address. If the passing signature's d= value is a different domain, for example a provider's, DKIM passes but doesn't help DMARC. Set up DKIM for your own domain under Authenticate email, and give third-party senders their own aligned DKIM keys.

## Sources

- [Google Workspace Admin Help: Troubleshoot DKIM issues](https://knowledge.workspace.google.com/admin/security/troubleshoot-dkim-issues)
- [Google Workspace Admin Help: Set up DKIM](https://knowledge.workspace.google.com/admin/security/set-up-dkim)
- [RFC 6376: DomainKeys Identified Mail (DKIM) Signatures, section 3.6.2.2](https://www.rfc-editor.org/rfc/rfc6376.html)
- [RFC 8601: Message Header Field for Indicating Message Authentication Status, section 2.7.1](https://www.rfc-editor.org/rfc/rfc8601.html)
- [RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc9989.html)

## Free tools for this guide

- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [DKIM Key Generator](https://iblockspam.com/tools/dkim-generator): Create a DKIM key pair and the DNS TXT record for your selector — keys are generated in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/google-workspace-dkim-not-authenticating (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt