--- title: "Enabling DKIM For Your Domain Using the Google Admin Console | DuoCircle" description: "Enabling DKIM For Your Domain Using the Google Admin Console." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/email-security/enabling-dkim-for-your-domain-using-the-google-admin-console/" --- Quick Answer Enabling DKIM for a domain on Google Workspace takes four steps. Step 1: get the DKIM key in the Admin console. Wait 24-72 hours after Gmail provisioning, then sign in as a super administrator, go to Menu > Apps > Google Workspace > Gmail, click Authenticate email, choose the domain, click Generate New Record, and pick a key length (2048-bit if your DNS host supports it, otherwise 1024) and selector prefix (default 'google'). Click Generate to produce the DNS Host name and TXT record value. Step 2: at your domain provider, add a TXT record with the host name and DKIM key value; check your provider's TXT length limit, allow 24-48 hours for propagation, and avoid the DKIM length tag (l=) which is exploitable. Repeat per domain since each gets a unique key. Step 3: back in the Admin console, return to Authenticate email, select the domain, and click Start Authentication; status changes to Authenticating email with DKIM. Step 4: send a test message to a different Gmail or Workspace account and check the recipient's full headers; DKIM=pass or DKIM=OK in Authentication-Results confirms it works. For domains hosted on Google servers without DKIM, Gmail signs with a default key (d=\*.gappssmtp.com). Enabling DKIM For Your Domain Using the Google Admin Console Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2024/06/Enabling-DKIM-For-Your-Domain-Using-the-Google-Admin-Console.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-security%2Fenabling-dkim-for-your-domain-using-the-google-admin-console%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Enabling%20DKIM%20For%20Your%20Domain%20Using%20the%20Google%20Admin%20Console&url=undefined%2Fblog%2Femail-security%2Fenabling-dkim-for-your-domain-using-the-google-admin-console%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-security%2Fenabling-dkim-for-your-domain-using-the-google-admin-console%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-security%2Fenabling-dkim-for-your-domain-using-the-google-admin-console%2F&title=Enabling%20DKIM%20For%20Your%20Domain%20Using%20the%20Google%20Admin%20Console "Share on Reddit") [ ](mailto:?subject=Enabling%20DKIM%20For%20Your%20Domain%20Using%20the%20Google%20Admin%20Console&body=Check out this article: undefined%2Fblog%2Femail-security%2Fenabling-dkim-for-your-domain-using-the-google-admin-console%2F "Share via Email") ![Domain protection](https://media.mailhop.org/duocircle/images/2024/06/spf-permerror-1.jpg) No matter what your organization’s size is and how many emails you send in a day, you can be a target of impersonation and [phishing attacks](https://www.infosecurity-magazine.com/news/phishing-attacks-us-europe-double/). So, ensure all your domains, including the parked ones, are secured with [SPF](/content/spf-record-check), DKIM, and [DMARC](/email/dmarc). In this guide, we are taking you through the **4 steps to enable DKIM** using the Google Admin console. For domains on Google servers that don’t have DKIM, **Gmail itself signs** all the outgoing emails with a default [DKIM key](/resources/dkim-generator), which is- d=\*.gappssmtp.com. But this doesn’t happen for non-Google servers. _Also, if your domain provider is [Google Domains](https://www.forbes.com/advisor/business/software/google-domains-review/), you don’t need to generate a pair of public and private keys._ Google will itself generate the keys and add them to your domain’s DNS record when you set up [Google Workspace](https://workspace.google.com/). If you are not subjected to the above cases, then **follow the steps** in this guide. ## STEP 1- Get Your DKIM Key in Your Admin Console To do this task, you should be signed in as a [super administrator](https://cloud.google.com/resource-manager/docs/super-admin-best-practices). Also, **wait for 24-72 hours** after turning on Gmail for your organization to get your DKIM key in the Admin console. _If you try producing a key before the waiting period, you will come across the ‘DKIM record not created’ prompt._ [![Domain security](https://media.mailhop.org/duocircle/images/2024/06/office-365-migration-service.jpg)](https://media.mailhop.org/duocircle/images/2024/06/office-365-migration-service.jpg) Here are steps to get your DKIM key in your Admin console- 1. Use your login credentials to sign in to your **Google Admin console**. Ensure you sign in using an administrator account and not your personal account. 2. In the Admin console, go to **Menu** \> **Apps** \> **Google Workspace** \> **Gmail**. 3. Click ‘**Authenticate email**.’ 4. In the **Selected Domain** menu, select the domain where you want to set up [DKIM](/resources/what-is-dkim). 5. Click the ‘**Generate New Record’** button. Then, **select your key settings**. | Setting | Options | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DKIM Key Bit Length | 2048, If your domain provider supports 2048-bit keys, choose this option. Longer keys offer greater security compared to shorter keys. If you previously used a 1024-bit key, you can [upgrade to a 2048-bit key](https://www.mailjet.com/blog/deliverability/dkim-1024-vs-2048/), provided your domain provider supports it. 1024, If your domain host doesn’t support 2048-bit keys, then you choose 1024-bit DKIM keys. | | Prefix Selector | ‘google’ is the [selector prefix](https://support.google.com/a/answer/11611356) by default and Google recommends using this only. If your domain already uses a DKIM key with ‘google’ as the prefix, enter a different prefix in this field. | 1. Look at the bottom of the **Generate New Record** box. There will be a ‘**Generate**’ button; click on it. Then, on the settings page, the text string below the **TXT record value** will change to a new value, and you will see the ‘DKIM authentication settings updated’ prompt. 2. You will see the DKIM values in the ‘**Authenticate email**,’ which you have to copy and add to your domain provider in the next step: - - **DNS Host name (TXT record name)**: It’s the name for the DKIM TXT record you’ll add to your domain provider’s DNS records. Enter this name in the Host field. - **TXT record value**: This text is the DKIM key. You’ll add this to your [DKIM TXT record](https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/). Enter the key in the **TXT Value field**. Sign in to your domain provider for the following steps. ## STEP 2: Adding the TXT Record Name and DKIM Key to Your Domain After you log in to your domain provider, add the information you received in the first step. 1. Log in to the **management console** of your domain provider’s platform. 2. Find an option to update [DNS settings](https://www.ntchosting.com/encyclopedia/dns/settings/). 3. Add a TXT record for DKIM: - - In the first field, enter the **DNS Hostname** (TXT record name). - In the second field, enter the TXT record value (DKIM key). 4\. Save changes. Once done, **go back to the Admin console** for the next step. Please bear the following points in mind- - Some domain providers impose a [limit on the TXT record length](https://support.google.com/a/answer/11613097); so **check in advance**. - After you add your DKIM key, it takes 24 to 48 hours for it to propagate on the Internet and start reflecting. - _If you are configuring DKIM for multiple domains, complete the steps below for all of them._ Also, you need to get a **unique key from the Admin console** for all the domains. - It’s discouraged to use the [DKIM length tag (l=)](https://dmarcreport.com/blog/decoding-i-tag-dkim-vulnerability-and-its-impact-on-email-security/) as emails sent using it are **vulnerable to cyber abuse** for attempting phishing and [spoofing attacks](https://www.darkreading.com/cybersecurity-analytics/ai-dual-role-smb-brand-spoofing). ## STEP 3: Turn on DKIM Signing 1. Use your login credentials to sign in to your Google Admin console. Ensure you **sign in using an administrator account** and not your personal account. 2. In the Admin console, go to **Menu** \> **Apps** \> **Google Workspace** \> **Gmail**. 3. Click ‘**Authenticate email**.’ 4. In the **Selected Domain** menu, select the domain where you want to turn on DKIM. 5. Click on the ‘**Start Authentication**’ button, and when the setup process is complete, you will notice that the status at the top of the page will change to ‘**Authenticating email with DKIM**.’ ### Disabling DKIM We **don’t recommend** turning off DKIM for your domain. Without DKIM, [hackers can impersonate](https://www.theregister.com/2023/12/07/attacks%5Fabuse%5Fmicrosoft%5Fdhcp/) your domain and [send fake messages](https://www.thestar.com.my/aseanplus/aseanplus-news/2024/04/10/pair-from-hk-held-in-bangkok-mall-with-tool-for-sending-fake-sms-messages) that seem to come from you. Your emails are also more **likely to end up in spam**. Still if you have to turn off DKIM, follow these steps. 1. Use your login credentials to sign in to your Google Admin console. Ensure you **sign in using an administrator account** and not your personal account. 2. In the Admin console, go to **Menu** \> **Apps** \> **Google Workspace** \> **Gmail**. 3. Click ‘**Authenticate email**.’ 4. On the ‘**Authenticate email**’ page, click the ‘**Stop authentication**’ button. ## STEP 4: Verify if DKIM is Enabled 1. Since you can’t verify if DKIM is enabled by sending a test email to yourself, you have to **send a message to another Gmail** or Google Workspace user. 2. Open the email in the recipient’s inbox and **find the full header**. 3. In the message header, find ‘**Authentication-Results**.’ Different receiving services may format message headers differently, but the DKIM results should indicate something like **DKIM=pass or DKIM=OK**. _If your DKIM is still not on, **verify** that you completed all the above-mentioned steps correctly._ If the issue still persists, reach out to us at [support@duocircle.com](mailto:support@duocircle.com). [![email security](https://media.mailhop.org/duocircle/images/2024/06/sendgrid-alternative-7195.jpg)](https://media.mailhop.org/duocircle/images/2024/06/sendgrid-alternative-7195.jpg) We have a team of [email security](/) experts in SPF, DKIM, and DMARC who will find the flaw in your configuration or **even do it from scratch**. We are committed to securing domains from phishing and spoofing attacks through [email authentication](/resources/email-authentication). ## Topics email securityUpdates ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ Email Security 7m 10 Crucial Tips that Will Help You Avoid Spam Filters and Send Better Emails Feb 14, 2023 ](/blog/email-security/10-crucial-tips-that-will-help-you-avoid-spam-filters-and-send-better-emails/)[ Email Security 6m 5 Reasons Why Your Website Needs an SPF Record Flattener? Sep 26, 2023 ](/blog/email-security/5-reasons-why-your-website-needs-an-spf-record-flattener/)[ Email Security 8m Best Practices to Follow When Implementing SPF, DKIM, and DMARC Mar 19, 2024 ](/blog/email-security/best-practices-to-follow-when-implementing-spf-dkim-and-dmarc/)[ Email Security 3m Best Ways to Secure Emails in 2024 Apr 26, 2024 ](/blog/email-security/best-ways-to-secure-emails-in-2024/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Enabling DKIM For Your Domain Using the Google Admin Console","description":"Enabling DKIM For Your Domain Using the Google Admin Console.","url":"https://www.duocircle.com/blog/email-security/enabling-dkim-for-your-domain-using-the-google-admin-console/","datePublished":"2024-06-14T19:40:16.000Z","dateModified":"2025-04-23T15:14:45.000Z","dateCreated":"2024-06-14T19:40:16.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/enabling-dkim-for-your-domain-using-the-google-admin-console/"},"articleSection":"email-security","keywords":"email security, Updates","wordCount":1066,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/06/spf-permerror-1.jpg","caption":"Domain protection","width":900,"height":527},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Security"},{"@type":"ListItem","position":3,"name":"Enabling DKIM For Your Domain Using the Google Admin Console","item":"https://www.duocircle.com/blog/email-security/enabling-dkim-for-your-domain-using-the-google-admin-console/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Enabling DKIM For Your Domain Using the Google Admin Console","item":"https://www.duocircle.com/blog/email-security/enabling-dkim-for-your-domain-using-the-google-admin-console/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Enabling DKIM For Your Domain Using the Google Admin Console","description":"Enabling DKIM For Your Domain Using the Google Admin Console.","url":"https://www.duocircle.com/blog/email-security/enabling-dkim-for-your-domain-using-the-google-admin-console/","datePublished":"2024-06-14T19:40:16.000Z","dateModified":"2025-04-23T15:14:45.000Z","dateCreated":"2024-06-14T19:40:16.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/enabling-dkim-for-your-domain-using-the-google-admin-console/"},"articleSection":"email-security","keywords":"email security, Updates","wordCount":1066,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/06/spf-permerror-1.jpg","caption":"Domain protection","width":900,"height":527},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```