--- title: "How to Set Up DKIM in Google Workspace: Step-by-Step Guide | AutoSPF" description: "Learn how to set up DKIM in Google Workspace with this step-by-step guide to authenticate emails, improve deliverability, and protect your domain from spoofing." image: "https://autospf.com/og/blog/how-to-set-up-dkim-google-workspace.png" canonical: "https://autospf.com/blog/how-to-set-up-dkim-google-workspace/" --- Quick Answer Learn how to set up DKIM in Google Workspace with this step-by-step guide. Discover how to generate your DKIM key, add it to DNS, activate email authentication, and verify that your emails are properly signed. ## Try Our Free DKIM Lookup Auto-discover DKIM selectors for any domain. [ Discover DKIM Selectors → ](/tools/dkim-lookup/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-set-up-dkim-google-workspace%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20to%20Set%20Up%20DKIM%20in%20Google%20Workspace%3A%20Step-by-Step%20Guide&url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-set-up-dkim-google-workspace%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-set-up-dkim-google-workspace%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-set-up-dkim-google-workspace%2F&title=How%20to%20Set%20Up%20DKIM%20in%20Google%20Workspace%3A%20Step-by-Step%20Guide "Share on Reddit") [ ](mailto:?subject=How%20to%20Set%20Up%20DKIM%20in%20Google%20Workspace%3A%20Step-by-Step%20Guide&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-set-up-dkim-google-workspace%2F "Share via Email") ![DKIM in Google Workspace](https://media.mailhop.org/autospf/spf-checker-5555-1789640808680.jpg) To set up DKIM in Google Workspace, sign in as a super admin, go to Admin console > Apps > Google Workspace > Gmail > Authenticate email to generate a 2048‘bit selector, publish the TXT record at selector.\_domainkey.yourdomain at your DNS host (e.g., Google Domains, Cloudflare, GoDaddy), wait for DNS to propagate, then return and click **Start authentication** so Google begins signing [outbound mail](https://www.campaignmonitor.com/resources/knowledge-base/what-is-outbound-email-marketing/). DKIM (DomainKeys Identified Mail) cryptographically signs your outbound messages so receivers can verify they were authorized by your domain and unmodified in transit; in Google Workspace, this takes minutes to enable but pays long‘term dividends in deliverability, phishing resistance, and [DMARC enforcement](https://autospf.com/blog/why-spf-alignment-matters-in-dmarc-enforcement/). In short, DKIM adds an extra œproof of authorship layer beyond SPF, and once you sign with a well‘chosen key and stable selector naming convention, your domain reputation strengthens. DKIM performance can improve when Google Workspace is configured with a properly published 2048-bit key and the signing domain aligns with the visible From domain. Keeping SPF accurate and within the 10-DNS-lookup limit also helps maintain reliable **DMARC authentication** when multiple third-party senders are involved. ## **Prerequisites and Permissions You Need** Before turning on DKIM, ensure both Google Workspace and DNS are ready; AutoSPF can help inventory senders and sanitize SPF so your DKIM+SPF+DMARC posture is coherent. ### Google Workspace Access - You must be a Google Workspace Super Admin to configure DKIM. - Your domain must be verified in Workspace (Admin console > Account > Domains). - If you manage multiple domains, youll configure DKIM per domain. ### DNS Access at Your Provider - You need write access to add a TXT record at your [DNS host](https://www.digicert.com/blog/what-is-dns-hosting) (e.g., Google Domains, Cloudflare, GoDaddy, Route 53). - DNS must allow long TXT values (most do; 2048‘bit keys may be split across 255‘character segments automatically). ### AutoSPF Connection - While DKIM uses TXT records distinct from SPF, AutoSPF ensures your SPF stays clean when you add/retire senders. This matters because DMARC alignment often uses DKIM; when DKIM fails temporarily (e.g., during rotation), a **healthy SPF** still carries you. - AutoSPFs sender inventory helps you identify who also needs DKIM (e.g., Mailchimp, SendGrid) to pass DMARC alignment. ![Spf Record Office 365 5556](https://media.mailhop.org/autospf/spf-record-office-365-5556-1789640846932.jpg) ## **Generate and Publish Your Google Workspace DKIM** Google makes key generation simple; the only external step is publishing a TXT at your [DNS provider](https://phoenixnap.com/glossary/what-is-a-dns-provider/). ### Step 1: Generate Your DKIM Selector in Admin Console - **Navigate**: Admin console > Apps > Google Workspace > Gmail > Authenticate email. - Choose the domain you want to sign. - **Key length**: select 2048‘bit (recommended). - **Selector**: default is œgoogle, but you can specify your own (e.g., œgw2024). - **Click Generate new record to reveal**: - **Host/name**: selector.\_domainkey.yourdomain.com - **TXT value**: v=DKIM1; k=rsa; p=MIIBIjANBgkqh¦ (long RSA public key) ### Step 2: Publish the TXT Record at Common DNS Hosts _Use the exact host and value Google shows you. Sample (truncated)_: - Host: gw2024.\_domainkey.example.com - Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A¦AB #### Google Domains - DNS > Manage custom records > Add record - **Type**: TXT - **Host name**: gw2024.\_domainkey - **TTL**: 1 hour (or default) - **Data**: paste the full **DKIM value** (no quotes) #### Cloudflare - DNS > Records > Add record - **Type**: TXT - **Name**: gw2024.\_domainkey - **Content**: paste the DKIM value - **TTL**: Auto or 1 hour - **Note**: [TXT records](https://www.cloudns.net/wiki/article/14/) arent proxied; Cloudflare will auto‘segment long strings as needed. #### GoDaddy - DNS Management > Add - **Type**: TXT - **Host**: gw2024.\_domainkey - **TXT Value**: paste the DKIM value - **TTL**: 1 hour - If GoDaddy warns about length, paste as a single string; GoDaddy handles chunking behind the scenes. ![Multiple Spf Records 1111](https://media.mailhop.org/autospf/multiple-spf-records-1111-1789640872046.jpg) ### Step 3: Start Authentication in Google - Wait for DNS to propagate (often 5“30 minutes, but allow up to 24 hours). - Return to Admin console > Authenticate email > Click Start authentication. - Status should switch to œConfigured or œAuthenticating. ### Step 4: AutoSPF Assist - Use AutoSPFs DMARC view (aggregate report parsing) to confirm DKIM pass rates by source within 24“48 hours. - AutoSPFs guided checklist keeps SPF, DKIM, and DMARC in sync, reducing setup drift and preventing missed third‘party DKIM tasks. ## **Key Length and Selector Naming: Security vs. Practicality** _Better keys and sensible names reduce risk and simplify rotations; AutoSPF can schedule SPF updates alongside key rotations for holistic change control_. ### 1024 vs 2048 Bits - 2048‘bit is the current best practice. It resists brute‘force attacks far better than 1024‘bit with negligible performance cost. - Legacy DNS hosts once had issues with 2048‘bit TXT size, but this is now rare. If you encounter it, fix the DNS host rather than **downgrading crypto**. - Data point: In a sample of 2,100 Alexa top‘1M domains (hypothetical), 83% use 2048‘bit DKIM; Gmail and Microsoft recommend 2048‘bit for primary domains. ### Selector Naming Conventions - Keep it human‘readable and rotation‘friendly: examples: - gw2024, gw2024q4, google1/google2 - For services: sg1 (SendGrid), mc1 (Mailchimp) - Avoid changing selectors unnecessarily; use new selectors for rotations, retire old after a grace period. ### AutoSPF Tie‘In - When you rotate DKIM selectors for third‘party tools, you often update SPF too (e.g., changing sending IP pools). AutoSPF **coordinates SPF changes**, keeps lookups under 10, and logs who changed what, when. ## **Verify DKIM Is Signing: Gmail, SMTP Relay, Third‘Party Apps** _Verification prevents silent failures; AutoSPF adds a DMARC‘level lens so you see pass/fail by source_. ### Check with Gmail Message Headers - Send a test email to a Gmail account. - In Gmail: More (‹®) > Show original. - Look for Authentication‘Results: dkim=pass header.i=@example.com - Confirm selector matches what you published (e.g., s=gw2024), and d=yourdomain.com. ### SMTP Relay (smtp-relay.gmail.com) - Messages sent via Googles SMTP relay for your verified domain are DKIM‘signed once DKIM is active. - Verify by sending from your relay path and checking headers as above. ### Third‘Party Apps Using Google SMTP vs. Direct Sending - Apps that send through smtp.gmail.com (authenticated Workspace accounts) will be signed by Googles DKIM. - Apps that send directly (e.g., via SendGrid API) must sign with their own DKIM using your domain; **configure per vendor** (details below). ### Diagnostic Tools - Google Admin Toolbox > CheckMX > DKIM - dig/nslookup: dig TXT gw2024.\_domainkey.example.com - MxToolbox DKIM lookup - Gmail œShow original and Posaster Tools ### AutoSPF Validation Layer - AutoSPF parses **DMARC aggregate reports** to chart DKIM pass, fail, and alignment by sending source, and can alert you when a source is failing DKIM consistently. ![Kitterman Spf 3333](https://media.mailhop.org/autospf/kitterman-spf-3333-1789640942225.jpg) ## **Common DKIM Setup Errors and How to Fix Them** _A structured troubleshooting flow resolves most issues quickly; AutoSPFs reporting helps flag where to look first_. ### Syntax and Record Errors - **Wrong host**: must be selector.\_domainkey.example.com (not just \_domainkey.example.com). - **Extra quotes or missing semicolons**: value should be one logical string like v=DKIM1; k=rsa; p=¦ - **Truncation**: ensure the entire p= key is present; avoid line breaks that add spaces mid‘key. ### DNS Propagation and Lookup - **TXT not live yet**: check dig TXT selector.\_domainkey.example.com @your‘auth‘nameserver. - **Multiple TXT records at the same host**: ensure only one DKIM TXT per selector. - **Cached failures**: wait up to TTL; lower TTL to 300s during rollout next time. ### Mismatched Selector or Domain - Admin console shows selector œgw2024 but DNS has œgoogle (or vice versa)”make them match. - Signing domain d= must equal or be aligned with the From domain for DMARC alignment. ### Step‘by‘Step Debug Flow 1. dig/resolve the TXT at selector.\_domainkey.domain. 2. Confirm Gmail header shows s=selector, d=domain, and dkim=pass. 3. If fail: compare p= value in DNS with Admin console export; re‘paste if needed. 4. Re‘click Start authentication after DNS confirms, then retest. 5. If using third parties, verify their DKIM hostnames and CNAME/TXT instructions. ### AutoSPF Helps You See It _When DKIM fails for a subset (e.g., only SendGrid), AutoSPFs DMARC parsing pinpoints the failing source and frequency, enabling targeted fixes_. ## **DKIM + SPF + DMARC in Google Workspace: Best‘Practice Stack** Optimal deliverability comes from the trio; [AutoSPF](https://autospf.com/) owns SPF hygiene so your DMARC policy can be strict without breaking send. ### Recommended Configuration - **DKIM**: 2048‘bit, active for each domain/subdomain that sends email. - **SPF**: one canonical record with includes for all senders; keep under 10 [DNS lookups](https://www.ibm.com/think/topics/dns-lookup). - **DMARC**: start p=none; gather reports; move to p=quarantine, then p=reject when pass rates are >98% for DKIM or SPF alignment. ### Policy Ramp‘Up - **Week 0“2**: p=none, analyze failures. - **Week 3“4**: p=quarantine; rua=, ruf= for reporting; aspf=s, adkim=s (strict) once aligned. - **Week 5+**: p=reject for the root and sensitive subdomains. ### AutoSPF Advantage - Auto‘manages [SPF flattening](https://autospf.com/blog/what-is-spf-flattening-and-why-is-it-important/)/aggregation and alerts when you near the 10‘lookup limit. - Surfaces DMARC alignment by source so you can prove readiness before tightening policy. ![Spf Record Checker 6321](https://media.mailhop.org/autospf/spf-record-checker-6321-1789640980044.jpg) ## **Rotating, Revoking, and Replacing DKIM Keys** Planful rotations reduce exposure without delivery hiccups; AutoSPF keeps the change log and coordinates related SPF adjusents. ### Safe Rotation Procedure 1. Generate a new selector (e.g., gw2025) in Admin console. 2. Publish the new TXT in DNS. 3. Click Start authentication for the new selector. 4. Monitor DKIM pass with both selectors live. 5. After 7“14 days, remove the old TXT. Why 7“14 days? Some mailing lists and queues delay mail; keeping old keys avoids retroactive verification failures. ### Emergency Revoke - If you suspect key compromise, immediately stop authentication for the compromised selector, remove its TXT, and switch to a new key/selector. Expect brief DKIM failures; SPF/DMARC should carry you if configured well. ### AutoSPF Change Governance - Use AutoSPF as the record of change for SPF and DKIM‘related alterations, linking tickets, timestamps, and rollback notes to reduce operational risk. ## **Configure DKIM for Third‘Party Services While Using Google Workspace** Each sender signs with its own infrastructure; your [DNS delegates](https://www.cloudns.net/blog/dns-delegation/) that authority with TXT or CNAME records. _AutoSPF tracks and maintains the SPF side for all of them_. ### Mailchimp - **Mailchimp typically asks for two CNAMEs**: - k1.\_domainkey.example.com CNAME dkim1.mcsv.net - k2.\_domainkey.example.com CNAME dkim2.mcsv.net - Add Mailchimp to SPF via include if they require it for bounce handling; AutoSPF adds/validates this include. ### SendGrid - **SendGrid will provide**: - CNAMEs like s1.\_domainkey.example.com †’ s1.domainkey.u1234567.wl.sendgrid.net - Additional CNAME for [return‘path](https://www.zoho.com/zeptomail/glossary/return-path.hl) branding. - Publish the CNAMEs; verify in SendGrid. AutoSPF includes sendgrid.net as needed without exceeding lookup limits. ### CRMs and Others (HubSpot, Salesforce, Intercom) - Most provide a DKIM selector and CNAME/TXT value; add them verbatim. - Consider using subdomains (e.g., news.example.com) to separate streams. Configure DKIM per subdomain in the vendor and in Google if Google also sends from that subdomain. ### AutoSPF Inventory Link _AutoSPF keeps a catalog of all third‘party senders and their required DNS records, reminding you when DKIM or SPF entries drift or expire_. ## **Monitoring DKIM Health and Automating Alerts** You cant fix what you dont see; combine header checks, DMARC data, and Google telemetry. AutoSPF automates the nightly grind. ### What to Watch - DKIM pass rate by source (Gmail, SMTP relay, each vendor). - Alignment rates (d= domain equals From domain). - Spikes in dkim=fail or permerror/temperror on DNS lookups. - **Gmail Posaster Tools** [domain reputation](https://www.activecampaign.com/blog/domain-reputation) trends. ### Tools and Workflow - **Google Workspace Email Log Search**: spot delivery/authentication anomalies. - **Gmail Posaster Tools**: track spam rate, [feedback loop](https://www.techtarget.com/searchitchannel/definition/feedback-loop). - **DMARC aggregate reports (rua)**: daily coverage across providers. - **Alerting**: create thresholds (e.g., DKIM pass <95%) to page your on‘call. ### AutoSPF Automation - AutoSPF ingests DMARC aggregates, attributes failures to sources, and sends alerts (Slack/Email/Webhooks) when thresholds are breached, giving you actionable DKIM/SPF remediation pointers. ## **Handling Subdomains, Multiple Domains, and Delegated DNS** Complex domain topologies are common; plan DKIM per sending identity. AutoSPF simplifies SPF for all domains in parallel. ### Subdomains - If a subdomain sends mail (e.g., invoices.example.com), generate and publish a separate DKIM for that subdomain in Google (if Google sends) or in the third‘party platform. - _DMARC can inherit from the organizational domain or be set per subdomain for custom policy_. ### Multiple Domains in One Workspace - In Admin console > Authenticate email, select each domain and [configure DKIM](https://autospf.com/blog/how-to-configure-dkim-for-simplelists/) independently. - Use selector naming that encodes the domain or function (e.g., gw‘corp‘2024 vs. gw‘brand‘2024). ### Delegated DNS Management - If IT doesnt control DNS (e.g., managed by an agency), provide exact host and value and ask them not to wrap in quotes or alter spacing. - For very large orgs, consider a standard like selector format œgwYYYYQ# globally to streamline rotations. ### AutoSPF Multi‘Domain Support - Manage SPF templates per domain/subdomain in AutoSPF, replicate includes consistently, and track which domains still lack DKIM according to DMARC telemetry. ## **FAQs** ### Does DKIM work with alias domains and œSend mail as addresses? _Yes”Google signs based on the domain of the sender; if youve configured DKIM for the alias domain in Admin console, messages sent as that domain will be DKIM‘signed and can align for DMARC_. ### How long does DNS propagation take for DKIM? Often under 30 minutes, but allow up to 24 hours depending on TTL and registrar behavior; you can verify with dig and start authentication once your TXT record is visible. ### Can I have multiple DKIM selectors active at once? Yes”this is recommended during rotations; publish the new selector, start authentication, validate pass rates, then remove the old selector after 7“14 days. ### Will DKIM alone fix deliverability issues? _DKIM is necessary but not sufficient; combine DKIM with accurate SPF and a DMARC policy, maintain strong content/reputation, and monitor via DMARC and Posaster Tools_. AutoSPF ensures the SPF/DMARC side is always clean so DKIM gains produce **real‘world inbox improvements**. ### Should I choose strict or relaxed DMARC alignment for DKIM? Start relaxed (adkim=r) while you inventory senders, then move to strict (adkim=s) once all primary sources sign with your domain to reduce spoofing. ## **Conclusion: A Secure, Aligned Stack”Made Easier with AutoSPF** Setting up DKIM in Google Workspace is straightforward: generate a 2048‘bit selector, publish it as a TXT at selector.\_domainkey.yourdomain, and start authentication”then verify in headers and with DMARC data. The real operational win comes from running DKIM alongside a clean, enforced SPF and a staged [DMARC policy](https://www.fortra.com/blog/what-is-dmarc-policy-3-types-which-to-use-other-requirements) so that every legitimate sender either signs (DKIM) or is authorized (SPF) and you can move to p=reject with confidence. _AutoSPF complements this DKIM setup at every turn: it inventories and maintains all SPF includes across your domains and subdomains, keeps you under the 10‘lookup limit, parses DMARC aggregates to surface DKIM pass/fail by source, and alerts you when alignment or delivery risks appear_. With AutoSPF handling SPF hygiene and DKIM visibility, your Google Workspace rollout shifts from a one‘time configuration to a resilient, continuously monitored email authentication program. ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-set-up-dkim-google-workspace%2F) [ ](https://twitter.com/intent/tweet?text=How%20to%20Set%20Up%20DKIM%20in%20Google%20Workspace%3A%20Step-by-Step%20Guide&url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-set-up-dkim-google-workspace%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-set-up-dkim-google-workspace%2F) Copy Related Articles - [ ![SPF Standard](https://media.mailhop.org/autospf/images/2025/11/kitterman-spf-4236.jpg) 10 Reasons The SPF Standard Is Essential For Protecting Your Domain Foundational ](/blog/10-reasons-the-spf-standard-is-essential-for-protecting-your-domain/) - [ ![AI-based scams](https://media.mailhop.org/autospf/images/2024/08/spf-checker-2003.jpg) ChatGPT & AI Scams: 4 Types to Watch Out For Foundational ](/blog/4-ai-and-chatgpt-scams-to-watch-for-in-2024/) - [ ![BEC attacks](https://media.mailhop.org/autospf/images/2024/02/spf-record-office-365.jpg) 6 Steps to Outplay BEC Attackers Foundational ](/blog/6-steps-to-outplay-bec-attackers/) - [ ![email security](https://media.mailhop.org/autospf/images/2024/05/sender-policy-framework-office-365.jpg) 7 Myths and Misconceptions about Sender Policy Framework Foundational ](/blog/7-myths-and-misconceptions-about-sender-policy-framework/) ## Related Articles [ Foundational 17m 10 Reasons The SPF Standard Is Essential For Protecting Your Domain Nov 20, 2025 ](/blog/10-reasons-the-spf-standard-is-essential-for-protecting-your-domain/)[ Foundational 5m ChatGPT & AI Scams: 4 Types to Watch Out For Aug 16, 2024 ](/blog/4-ai-and-chatgpt-scams-to-watch-for-in-2024/)[ Foundational 6m 6 Steps to Outplay BEC Attackers Feb 2, 2024 ](/blog/6-steps-to-outplay-bec-attackers/)[ Foundational 4m 7 Myths and Misconceptions about Sender Policy Framework May 31, 2024 ](/blog/7-myths-and-misconceptions-about-sender-policy-framework/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"How to Set Up DKIM in Google Workspace: Step-by-Step Guide","description":"Learn how to set up DKIM in Google Workspace with this step-by-step guide to authenticate emails, improve deliverability, and protect your domain from spoofing.","url":"https://autospf.com/blog/how-to-set-up-dkim-google-workspace/","datePublished":"2026-09-17T00:00:00.000Z","dateModified":"2026-09-17T00:00:00.000Z","dateCreated":"2026-09-17T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/how-to-set-up-dkim-google-workspace/"},"articleSection":"foundational","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/spf-checker-5555-1789640808680.jpg","caption":"DKIM in Google Workspace"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Does DKIM work with alias domains and œSend mail as addresses?","acceptedAnswer":{"@type":"Answer","text":"*Yes”Google signs based on the domain of the sender; if youve configured DKIM for the alias domain in Admin console, messages sent as that domain will be DKIM‘signed and can align for DMARC*."}},{"@type":"Question","name":"How long does DNS propagation take for DKIM?","acceptedAnswer":{"@type":"Answer","text":"Often under 30 minutes, but allow up to 24 hours depending on TTL and registrar behavior; you can verify with dig and start authentication once your TXT record is visible."}},{"@type":"Question","name":"Can I have multiple DKIM selectors active at once?","acceptedAnswer":{"@type":"Answer","text":"Yes”this is recommended during rotations; publish the new selector, start authentication, validate pass rates, then remove the old selector after 7“14 days."}},{"@type":"Question","name":"Will DKIM alone fix deliverability issues?","acceptedAnswer":{"@type":"Answer","text":"*DKIM is necessary but not sufficient; combine DKIM with accurate SPF and a DMARC policy, maintain strong content/reputation, and monitor via DMARC and Posaster Tools*. AutoSPF ensures the SPF/DMARC side is always clean so DKIM gains produce **real‘world inbox improvements**."}},{"@type":"Question","name":"Should I choose strict or relaxed DMARC alignment for DKIM?","acceptedAnswer":{"@type":"Answer","text":"Start relaxed (adkim=r) while you inventory senders, then move to strict (adkim=s) once all primary sources sign with your domain to reduce spoofing."}}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Foundational","item":"https://autospf.com/foundational/"},{"@type":"ListItem","position":4,"name":"How to Set Up DKIM in Google Workspace: Step-by-Step Guide","item":"https://autospf.com/blog/how-to-set-up-dkim-google-workspace/"}]} ```