1Open the Google Admin console
Sign in at admin.google.com with a super-admin account. DKIM is an admin-only setting; a normal user cannot enable it.
Turn on DKIM signing in Google Workspace
Generate a key in the Admin console, paste one TXT record, click Start authentication — done in five minutes.
The process
The complete path through the Admin console. Each crumb jumps to its step in Directions.
Directions
2Apps → Google Workspace → Gmail
From the Admin home go to Apps, then Google Workspace, then Gmail. Open the Authenticate email panel.
3Generate a new DKIM record
Pick the domain, choose a 2048-bit key (the default and current recommendation), and click Generate New Record. Google shows you a selector (google) and a long TXT value.
Host: google._domainkey Type: TXT Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQ... (long key)
4Publish the TXT record
In your DNS host add the TXT record at host google._domainkey. The key is long; if your panel splits long TXT values, paste it as a single string and let the panel chunk it — do not add your own quotes mid-value.
5Click Start authentication
Return to the Admin console and press Start authentication. Wait for DNS to propagate (up to an hour). Once active, outgoing Gmail is DKIM-signed with your domain.
Common issues & fixes
Start authentication is greyed out / errors.
DNS has not propagated yet, or the host name is wrong. It must be exactly google._domainkey.example.com. Wait and retry.
The TXT value got truncated.
2048-bit keys exceed 255 characters and must be split into chunked strings. Most DNS panels do this automatically — paste the raw value, don't manually break it.
DKIM passes but DMARC still fails.
DKIM must align with your From: domain. If you send from a subdomain, generate DKIM for that subdomain too.
You rotated keys and signing stopped.
Generate the new record, publish the new TXT, and only then switch the selector. Don't delete the old TXT until the new one is verified.
Written and maintained by Ben McDaniel. Drafted with AI assistance and human-reviewed against each vendor's current setup flow. Vendor interfaces change — if a step looks different, the underlying record is what matters.