Authentication
How DKIM Signing Works for Google Workspace Mail
Quick Answer
DKIM signing works by generating a cryptographic key pair in the Workspace Admin console, publishing the public key as a DNS TXT record, and then enabling signing so outgoing mail is signed with the matching private key automatically.
DKIM has three distinct steps - generate, publish, enable - and a common mistake is completing only the first one or two and assuming it is fully working.
Common Causes
- A DKIM key generated but never published in DNS.
- A key published in DNS but signing never turned on in the Admin console.
- A mismatch between the selector name in DNS and what Workspace expects.
Safe Troubleshooting Steps
- Generate a DKIM key under Apps > Gmail > Authenticate email in the Admin console.
- Publish the resulting TXT record at the exact selector and host shown.
- Return to the Admin console and turn on DKIM signing once the record is live in DNS.
- Send a test email and check the message headers for a DKIM=pass result.
What to Verify
- The DKIM record is confirmed live in DNS via an independent lookup.
- Signing is explicitly turned on in the Admin console, not just generated.
- A test message shows DKIM=pass in its headers.
When Professional Help May Be Useful
If DKIM shows as generated but a test message still shows DKIM=none or DKIM=fail, that gap between the three steps is exactly the kind of thing worth a second look.