DKIM record for Google Workspace

The DNS records

Copy the value from the Admin console; the key below is shortened. Each domain in your account gets its own key.

Google Workspace DKIM key

Type: TXT · Host: google._domainkey Copy

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…IDAQAB

Paste the whole value the Admin console shows, starting at v=DKIM1.

The same key split for a DNS host with a 255-character limit

Type: TXT · Host: google._domainkey Copy

"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…" "…IDAQAB"

Google says a 2048-bit key can't be entered as one text string at a host with a 255-character limit: split it into several strings, each in quotes. Receivers join the strings back together.

Set it up and turn on signing

1. Sign in to the Google Admin console as a super administrator and go to Menu > Apps > Google Workspace > Gmail > Authenticate email. If you turned on Gmail recently, Google says to wait 24 to 72 hours before a key can be generated.
2. Choose the domain under Selected domain and click Generate New Record. Pick the key length, keep the prefix selector google unless that name is already used at this domain, and click Generate.
3. Copy the DNS Host name (TXT record name) and the TXT record value. Don't click Start authentication yet.
4. At your DNS host, add a TXT record with that name and value. If Squarespace hosts your domain's DNS, Google says the record is added for you.
5. Back in the Admin console, click Start authentication. The status changes to "Authenticating email with DKIM". For up to 48 hours the console may still say you must update the DNS records while DNS catches up.

DMARC alignment

Mail is signed with d= your own domain only after the TXT record is live and authentication is started for that domain. Google asks for a separate key for every domain in the account, so a secondary domain isn't covered by the primary domain's record. The signature is added as Gmail sends, so an outbound gateway or relay that later adds a footer or rewrites the message breaks it, and DMARC then depends on SPF alone.

Key length and rotation

Google offers 2048-bit keys, recommended whenever your DNS host accepts them, and 1024-bit keys for hosts that don't. The key lives in your zone as a TXT record, so a new key means a new record. Generating it under a different prefix selector lets the old and new keys stay published side by side while you switch, which is what selectors are for (RFC 6376 section 3.1). Our DKIM key rotation guide covers the timing.

Common mistakes

• A 2048-bit key pasted as one string. Hosts that cap a TXT string at 255 characters save it cut short or refuse it. Split it into quoted strings, or use a 1024-bit key if the host can't.
• Clicking Start authentication too early. Publish the TXT record first; Google checks it when you click.
• A key for the primary domain only. Each domain you send from needs its own record from the Admin console.
• A record name that doesn't match the selector. If you changed the prefix from google, the host must be <prefix>._domainkey.