# DKIM record for Google Workspace URL: https://iblockspam.com/dkim/google-workspace Last updated: 2026-10-09 Record type: TXT Selectors: google Key managed by: Provider (you publish its key) Google Workspace (formerly G Suite) DKIM is a TXT record at `google._domainkey` that holds a public key Google generates for your domain in the Admin console. You publish the record at your DNS host, then click Start authentication. Google recommends a 2048-bit key and offers 1024 bits only for DNS hosts that can't store the longer value. ## DNS records - Google Workspace DKIM key (TXT, host google._domainkey): `v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…IDAQAB` Paste the whole value the Admin console shows, starting at `v=DKIM1`. - The same key split for a DNS host with a 255-character limit (TXT, host google._domainkey): `"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…" "…IDAQAB"` Google says a 2048-bit key can't be entered as one text string at a host with a 255-character limit: split it into several strings, each in quotes. Receivers join the strings back together. ## Set it up and turn on signing - Sign in to the Google Admin console as a super administrator and go to **Menu > Apps > Google Workspace > Gmail > Authenticate email**. If you turned on Gmail recently, Google says to wait 24 to 72 hours before a key can be generated. - Choose the domain under **Selected domain** and click **Generate New Record**. Pick the key length, keep the prefix selector `google` unless that name is already used at this domain, and click **Generate**. - Copy the **DNS Host name (TXT record name)** and the **TXT record value**. Don't click Start authentication yet. - At your DNS host, add a TXT record with that name and value. If Squarespace hosts your domain's DNS, Google says the record is added for you. - Back in the Admin console, click **Start authentication**. The status changes to "Authenticating email with DKIM". For up to 48 hours the console may still say you must update the DNS records while DNS catches up. ## DMARC alignment Mail is signed with `d=` your own domain only after the TXT record is live and authentication is started for that domain. Google asks for a separate key for every domain in the account, so a secondary domain isn't covered by the primary domain's record. The signature is added as Gmail sends, so an outbound gateway or relay that later adds a footer or rewrites the message breaks it, and DMARC then depends on SPF alone. ## Key length and rotation Google offers 2048-bit keys, recommended whenever your DNS host accepts them, and 1024-bit keys for hosts that don't. The key lives in your zone as a TXT record, so a new key means a new record. Generating it under a different prefix selector lets the old and new keys stay published side by side while you switch, which is what selectors are for (RFC 6376 section 3.1). Our [DKIM key rotation guide](https://iblockspam.com/blog/dkim-key-rotation) covers the timing. ## Common mistakes - **A 2048-bit key pasted as one string.** Hosts that cap a TXT string at 255 characters save it cut short or refuse it. Split it into quoted strings, or use a 1024-bit key if the host can't. - **Clicking Start authentication too early.** Publish the TXT record first; Google checks it when you click. - **A key for the primary domain only.** Each domain you send from needs its own record from the Admin console. - **A record name that doesn't match the selector.** If you changed the prefix from `google`, the host must be `._domainkey`. **Q: Why won't my DNS host accept the Google Workspace DKIM key?** A 2048-bit key is longer than the 255 characters most hosts allow in one TXT string. Split the value into several quoted strings in the same record, or generate a 1024-bit key if your host can't store split strings. **Q: Why can't I generate a DKIM key in Google Workspace yet?** Google says to wait 24 to 72 hours after turning on Gmail before generating a key. You also need super administrator rights, or the Gmail settings privilege, to open the Authenticate email page. **Q: Do secondary domains in Google Workspace need their own DKIM key?** Yes. Google asks for a unique key from the Admin console for each domain. Choose the domain under Selected domain, generate its record, publish it at that domain's DNS host and start authentication for it separately. Sources: - Google Workspace Admin Help: Set up DKIM: https://knowledge.workspace.google.com/admin/security/set-up-dkim - Google Workspace Admin Help: Troubleshoot DKIM issues: https://knowledge.workspace.google.com/admin/security/troubleshoot-dkim-issues --- Source: iBlockSpam, https://iblockspam.com/dkim/google-workspace (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt