DKIM (DomainKeys Identified Mail) attaches a digital signature to every email your organization sends, letting the recipient's mail server confirm the message genuinely came from your domain and wasn't altered along the way. If your business uses Google Workspace for email, setting up DKIM takes just a few steps between the Google Admin Console and your domain's DNS zone.
How DKIM works, in plain terms
When DKIM is turned on, Google Workspace signs each outgoing message with a private cryptographic key. The recipient's mail server then looks up a matching public key published in your domain's DNS records to verify the signature. If it matches, the receiving server knows the message really came from your domain and wasn't tampered with in transit. This is one of the core building blocks of email trust, alongside SPF and DMARC.
What you'll need before you start
- Administrator access to your Google Workspace account.
- Access to edit your domain's DNS zone (through your Avalon hosting control panel if Avalon manages your domain's DNS, or wherever your nameservers point).
- Confirmation that the domain in question is actually verified and active in your Google Workspace account.
Step-by-step setup
- Open the Google Admin Console and sign in with an administrator account. Go to Apps > Google Workspace > Gmail.
- Generate a DKIM key. Select Authenticate email, choose the domain you're setting up, and click Generate new record. Google will let you pick a key length — 2048-bit is the stronger option and recommended if given the choice.
- Copy the generated TXT record. Google will display a DNS host name (something like
google._domainkey) and a long value string. - Add the record to your DNS zone. Log in to wherever your DNS is managed, create a new TXT record using the exact host name Google gave you, and paste in the value exactly as shown.
- Return to the Admin Console and start authentication. Once the DNS record has had time to propagate, select the domain and click Start authentication. This turns on DKIM signing for mail sent from that domain.
- If verification fails immediately, wait a bit longer for DNS propagation and try again — this is the most common cause of a failed first attempt.
Keeping DKIM healthy over time
- Rotate your key periodically. Regenerating your DKIM key roughly once a year (or sooner for sensitive environments) is good security hygiene.
- Keep SPF and DMARC configured too. DKIM is strongest as part of a full authentication setup — pair it with an SPF record and a DMARC policy for full protection.
- Watch your deliverability after enabling DKIM to confirm mail is landing in inboxes rather than spam.
FAQ
How long does DNS propagation take? Often within an hour, though it can occasionally take longer depending on your DNS provider and network caching.
Can I have more than one DKIM key for a domain? Yes — Google Workspace supports multiple keys, which is handy when rotating from an old key to a new one without any gap in signing.
What if authentication still fails after waiting? Double-check that the TXT record's host name and value were copied exactly, with no extra spaces or line breaks, then regenerate the key if needed.
