DKIM setup for Google Workspace is one of those tasks that looks intimidating the first time because it involves generating a key pair, but the actual process inside the admin console only takes a few minutes once you know where to click. This guide walks through it end to end, beginner-friendly, with no assumed DNS background.
What DKIM does, briefly
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every outgoing message. The receiving server checks that signature against a public key published in your domain's DNS. If it matches, the server knows the message genuinely came from your domain and wasn't altered in transit. It's one leg of the three-part authentication stack — for how it fits with the other two, see the Pillar Guide to DKIM, SPF, and DMARC Setup.
Step 1: Generate the DKIM key in Google Admin
You can easily generate the DKIM key in Google Admin by following the steps below: Sign in to Google Workspace Admin console with an administrator account. Go to Apps → Google Workspace → Gmail → Authenticate email. Select the domain you want to authenticate. Click Generate new record. Choose a key length — 2048-bit is the current standard; only use 1024-bit if your DNS host has character limits on TXT records. Google will generate a DKIM domain key and give you a DNS host name (the selector) and a TXT record value to publish.
Step 2: Publish the TXT record
Copy the host name and TXT value exactly as Google provides them — don't retype them, since a single character error breaks the signature match. Log into your DNS provider and add a new TXT record using those exact values. This step is identical in structure to publishing an SPF record, if you've already worked through how to set up an SPF record.
Step 3: Wait for propagation, then start authentication
Back in the Google Admin console, don't click "Start authentication" immediately — DNS changes can take anywhere from a few minutes to 48 hours to propagate, depending on your host's TTL settings. If you start authentication before the record has propagated, Google won't be able to verify it and will show an error. Give it time, then return and click Start authentication.
Step 4: Confirm it's working
Once authentication is active, verify the record is resolving correctly using a DKIM checker. Send yourself a test email and check the headers for a dkim=pass result — this confirms the signature is being applied and validated correctly.
Step 5: Don't stop at DKIM
DKIM on its own confirms message integrity, but it doesn't tell receiving servers what to do if authentication fails, and it doesn't control which servers are allowed to send as your domain in the first place. Once DKIM is live, move on to the DMARC record setup guide to close that gap — DMARC is what actually enforces the policy and gives you visibility into failures.
A note for multi-domain senders
If you're authenticating more than one or two Google Workspace domains for cold outreach, doing this admin console process manually for each one adds up fast, and it's easy to lose track of which domains are actually fully authenticated. Worth checking whether your sending platform can handle DKIM setup for Google Workspace domains automatically before you do it fifty times by hand.
FAQ
How long does DKIM setup for Google Workspace take?
Generating the key and publishing the TXT record takes about 10 minutes. The bigger variable is DNS propagation, which can take a few minutes up to 48 hours before you can safely click "Start authentication" in the admin console.
Should I use a 2048-bit or 1024-bit DKIM key?
Use 2048-bit unless your DNS provider has a character limit on TXT records that forces you to use 1024-bit. 2048-bit is the current standard and offers stronger protection.
Why does Google show an error when I click "Start authentication"?
This almost always means the DNS record hasn't propagated yet. Wait a bit longer after publishing the TXT record before attempting to start authentication again.
Can I set up DKIM for Google Workspace without admin access?
No. Generating and enabling DKIM requires Google Workspace administrator privileges, since it's configured through the Admin console under Gmail settings.
Do I need a separate DKIM setup for each domain in Google Workspace?
Yes. Each domain (and each alias domain sending independently) needs its own DKIM key generated and published, even within the same Google Workspace account.