Google Workspace: DKIM and SPF setup

Before you start

You need to sign in to the Google Admin console as a super administrator. The Gmail steps also need the Gmail Settings administrator privilege.

After you turn on Gmail for your organization, Google asks you to wait 24 to 72 hours before you generate a DKIM key. A key generated earlier can fail with an error that the DKIM record was not created.

You also need access to the DNS settings of example.com, usually at the company where you bought the domain.

Turn on DKIM

Google's steps come in three parts: generate a key, publish it, then start authentication.

1. In the Google Admin console, go to Apps > Google Workspace > Gmail.
2. Click Authenticate email, and select example.com in the Selected domain menu.
3. Click Generate New Record. Choose a 2048-bit key if your DNS host supports it, and 1024-bit if it does not.
4. Keep the prefix selector google, which is Google's default. Choose another prefix only if example.com already has a key at google.
5. Click Generate. Do not click Start authentication yet.
6. At your DNS host, add a TXT record. The name is the DNS Host name Google shows, usually google._domainkey. The value is the TXT record value, which starts with v=DKIM1.
7. Back on the Authenticate email page, select example.com and click Start authentication.

It can take up to 48 hours for DKIM to start working. When it works, the status at the top of the page reads Authenticating email with DKIM. The Admin console may keep showing "You must update the DNS records for this domain" for up to 48 hours. You can ignore that message if the record is in place.

If you use more than one domain, repeat the steps for each. Google gives each domain its own key.

Sign with your own domain

Reports show mail from Google Workspace that is DKIM-signed by a domain other than example.com. DMARC counts DKIM only when the signing domain is example.com or a subdomain of it. Generate a key for example.com and start authentication, as in Turn on DKIM.

Check the DKIM key

Google's troubleshooting page lists these checks:

1. On the Authenticate email page, select example.com. If the DNS host name and TXT record value are blank, example.com has no key yet. Generate one.
2. Compare the TXT record at google._domainkey.example.com with the value in the Admin console. Every character must match.
3. Most DNS hosts allow 255 characters per TXT string. A 2048-bit key is longer, so your host may need it split into two quoted strings. A key cut short fails.
4. If the status reads "Not authenticating", click Start authentication.

SPF

Google documents one include for Workspace: include:_spf.google.com. If Google Workspace is the only service that sends as example.com, the record is:

v=spf1 include:_spf.google.com ~all

Google recommends ~all. If example.com already has an SPF record, add include:_spf.google.com to it instead of adding a second record. A domain may have only one. Google says SPF can take up to 48 hours to start working.

Check it worked

1. The Authenticate email page reads Authenticating email with DKIM.
2. Send a message to someone on Gmail. You cannot test by sending to yourself. In Gmail, open the message, click More > Show original, and look for dkim=pass with d=example.com.
3. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM aligns for Google Workspace. The DKIM table on Mailmoni's DNS tab lists the google selector once a report includes it.

Google's pages: Set up DKIM, Troubleshoot DKIM issues and Set up SPF.