All guides · Updated: 2026-10-18

DKIM in Google Workspace: sign your emails with your own domain

We checked 1,500 small-business sites (Shopify stores, Wix sites and apps on Vercel). On half of those with email on Google Workspace, DKIM had never been turned on. It was the most common email problem we found, and it takes about 10 minutes to fix, plus the wait for DNS.

Without DKIM on your domain, Google signs your emails with one of its own domains. That signature never matches yours, so your protection against fake email (DMARC) rests on SPF alone, which breaks when a message is forwarded.

Before you start

You need a Google Workspace admin account and access to wherever you manage the domain's DNS: where you bought the domain, Cloudflare, Wix…

If you turned on Gmail less than 3 days ago, wait: Google only gives out the DKIM key 24 to 72 hours later.

Step 1: generate the key in the Google Admin console

Sign in to admin.google.com with the admin account.
Open Menu › Apps › Google Workspace › Gmail › Authenticate email.
Pick the domain and click Generate new record.
For key length, choose 2048. Only choose 1024 if your DNS provider doesn't accept long keys. Leave the prefix as google.
Click Generate. Google shows the record name and a long value starting with v=DKIM1.

Step 2: put the record in DNS

Wherever you manage DNS, add a TXT record:

Type: TXT
Name (host): google._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqh… (the full value Google shows)

Copy the whole value: it's long and sometimes doesn't fit on screen. In most panels you type just google._domainkey as the name, and the domain is added for you.

Cloudflare: DNS › Records › Add record, type TXT.
Other providers: search their help for “add TXT record”.

Some providers limit the length of a TXT record. If yours rejects the value, go back to step 1 and generate a 1024-bit key.

If your domain's DNS is on Wix: the Wix guide

Step 3: start authentication

Go back to the Google Admin console, on the same page, and click Start authentication. Once it's working, the status at the top of the page changes to “Authenticating email with DKIM”.

This is the step people forget most. Without it, the key is published but your emails still go out without your signature. DNS can take up to 48 hours: if Google can't find the record yet, try again later.

Step 4: check that it works

Send an email from your account to a Gmail account. Open it, click the three dots › Show original and look for the DKIM line: it should say PASS with your domain.

You can also check the domain here. If the warning “Google Workspace isn't signing your email with your domain” goes away, the key is published.

Mistakes we see often

The key published in DNS, but “Start authentication” never clicked.
Only part of the value copied, because it didn't fit on screen.
The domain typed into the record name and repeated by the panel. google._domainkey is enough.
An old 1024-bit key. It works, but Google recommends 2048: replace it when you have time, it isn't urgent.

What comes after DKIM?

With DKIM and SPF right, the next step is to make DMARC stop fake email: move from p=none to p=quarantine, without losing any email on the way.

From p=none to p=quarantine, step by step

So you don't have to check again

A change of email provider or a record deleted by mistake is enough to stop the signature working, and nobody notices. Excubitor can watch the domain every week and email you only when something changes. Free for 1 domain: run the check and press “Notify me”.