How to Generate Your DKIM Record in Google Workspace

DKIM is a signature Google adds to every email you send, which proves the message really came from your domain and was not forged. It has two halves: a private key that lives inside your Google Workspace account, and a matching public record published in your domain’s DNS. Until both halves exist and signing has been switched on, providers like Gmail and Outlook are entitled to reject your mail outright, which is what a “Message blocked, the sender is unauthenticated” bounce means.

Before you start

• You need to be an administrator of your Google Workspace account, not just a user of it. If signing in at the address below tells you that you do not have access, you are not an administrator, and you need whoever set up your email to do this or to make you one.
• This is a different login from your website. Being an admin of your site does not make you an admin of your email.
• Set aside five minutes. Most of it is copying one long line of text.

Generating the record

1. Go to admin.google.com and sign in with your Google Workspace administrator account.
2. In the left-hand menu, choose Apps, then Google Workspace, then Gmail.
3. Open Authenticate email.
4. If your organisation has more than one domain, pick the right one from the dropdown at the top. It must be the domain your email addresses actually end in.
5. Click Generate new record. If you are offered a key length, take 2048. If you are offered a prefix, leave it as google unless we have specifically asked for something else.
6. Google now shows you two things. Copy both, exactly as they appear:
   • The DNS host name, sometimes labelled the prefix. It usually looks like google._domainkey.
   • The TXT record value. This is a very long line starting v=DKIM1;. Select the whole thing. It is easy to grab only the visible part.
7. Stop there and send both to us. Do not click Start authentication yet. See the next section for why.

The order matters. Publish the record first, confirm it is live, then click Start authentication. Clicking it before the record is live can produce an error and you will have to come back anyway.

What to send us

Reply with these three things and we will do the rest:

1. The domain you generated it for.
2. The DNS host name or prefix.
3. The full TXT record value.

Copy and paste, never retype. The value is a few hundred characters of random-looking text and a single wrong character makes it useless. Pasting it into the body of an email is fine. There is nothing secret in it, which is the whole point of a public key.

We will add it, confirm when it has gone live, and then tell you to go back and click Start authentication.

If you would rather add it to your DNS yourself

Perfectly fine if you manage your own DNS. It is a TXT record:

• Type: TXT
• Host or Name: the prefix Google gave you, usually google._domainkey
• Value: the entire v=DKIM1; line
• TTL: leave the default

Then wait for it to go live, and click Start authentication in Google Admin. Tell us when it is done and we will check it from the outside.

How long it takes to work

Usually minutes. It can in theory take up to 48 hours, though that is rare now. Nothing changes about your email in the meantime, and there is no downtime or risk to your mail while you wait.

DKIM is one of two things, and SPF is the other

Gmail and Outlook want to see either SPF or DKIM pass, and ideally both. SPF is a separate DNS record listing who is allowed to send email for your domain. It is worth us checking yours at the same time, because a common cause of blocked mail is a newsletter tool or booking system sending on your behalf that was never added to SPF.

One rule if you are editing DNS yourself: a domain may only have one SPF record. Adding a second one breaks both. Extra senders get added inside the existing record, not alongside it.

If your email is still being blocked

Send us the bounce message, and include the technical part rather than just the screenshot of the red light. The line that begins 550 is the useful one, because it names which check failed.

Also tell us:

• The exact address you were sending from.
• Whether you send that mail from a proper Google Workspace mailbox, or from a personal Gmail account set up to send as that address. The second one authenticates differently and is a common cause of this exact bounce.
• Whether it fails to everyone, or only to certain recipients.

What we need if something fails

The domain, the bounce message including the 550 line, and the sending address. If you have already generated a record, tell us whether you clicked Start authentication and roughly when.

Related

• Google Workspace MX record values
• What not to touch, and when to email us instead