Google Workspace DKIM Setup (2025): A Step‑by‑Step Guide for Better Deliverability

If your Google Workspace DKIM isn’t configured correctly in 2025, you’ll likely face problems such as:

• Emails landing in spam instead of the inbox
• Frequent “dkim=fail” or “dmarc=fail” errors during outreach
• Spoofing or phishing attempts that misuse your domain

For teams running cold outreach or large campaigns, these issues quickly lead to missed opportunities, wasted effort, and damaged trust. That’s why the latest Google sender guidelines require administrators and email operators to set up DKIM properly.

This guide takes you step by step through the Google Workspace DKIM setup so you can prevent deliverability errors and keep your communication on track.

How Does Google Workspace DKIM Work ?

DKIM enables receiving mail servers to verify that your message was genuinely sent from your domain and that its contents remain intact during transmission.

Here’s how it works:

1. Google Workspace creates two keys: a private key and a public key
2. The private key stays secret on Google’s servers and is used to add a special signature to every email you send
3. The public key is added to your domain’s DNS records. When someone receives your email, their mail server looks up this key to verify the signature
4. If the signature matches, the email is confirmed as genuine and safe, so it goes into the inbox
5. If it doesn’t match, the email might be fake or altered, and could land in spam or get blocked

Essential Prerequisites for DKIM Setup

Before you start the Google Workspace DKIM setup, make sure you have the following in place:

Authorized Email Senders

Your domain may send emails through multiple platforms for example, cold outreach tools (e.g., Instantly, Lemlist), marketing automation services (e.g., Mailchimp, Brevo), or transactional email providers (e.g., SendGrid, Amazon SES).

Each of these services typically requires its own DKIM record with a unique selector. If you use several tools, you will need to create and publish a separate DKIM record for each one to ensure proper authentication.

Access to Your Email Sending Platform

DKIM keys are created in the platform that sends your emails, for example Google Workspace, Microsoft 365, Zoho, or Mailgun.

Make sure DKIM signing is enabled in your email sending platform before adding any DNS records.

A frequent oversight is publishing the DKIM record in DNS but failing to enable DKIM signing within Google Workspace. Without activation, the record remains unused, and your emails are not authenticated as intended.

Access to Your Domain’s DNS Settings

Log in to your DNS provider (like GoDaddy, Cloudflare, or Namecheap) to add a TXT or CNAME record. If you lack direct access, coordinate with your domain administrator or IT team to obtain the necessary permissions.

Active DKIM

Don’t assume DKIM is active just because the record is added. Check that your emails are actually signed.

You can also use MailReach’s free DKIM Checker after setup. Instructions are detailed later in this article.

Step-by-Step Google Workspace DKIM Setup Guide

Setting up DKIM is easier than it sounds. Follow these clear steps to add your DKIM records and improve your email deliverability.

Step 1: 

Log in to the Google Admin Console with a super admin account (the main admin for your domain). If you don’t have access, ask your IT admin or domain manager for access.

Step 2:

Navigate to: Apps → Google Workspace → Gmail → Authenticate Email.See your domains list. Select your sending domain. Click ‘Generate new record.’

Step 3:

Choose:

a) A selector name: use the default “google” unless you have a specific reason to change it.

b) A key length: select 2048-bit for stronger security.

Click Generate. Google will display:

a) A DNS Hostname (e.g., google._domainkey.yourcompany.com)

b) A TXT record value: a long string starting with v=DKIM1; k=rsa; p=... (this is your public DKIM key)

Step 4:

Go to your DNS provider’s dashboard (e.g., GoDaddy, Cloudflare, Namecheap, Google Domains). You’ll add a new TXT record here.

Step 5:

In the DNS dashboard:

a) Click Add new record

b) Set Type to TXT

c) Enter the Name/Host as google._domainkey (omit the full domain if your provider adds it automatically)

d) Paste the TXT record value from Google as the record’s value

e) Save the record

DNS changes usually update in 5–30 minutes but can take up to 24 hours.MailReach Tip: Use your DNS provider’s preview or a propagation check tool to confirm that TXT record is live.

Step 6:

Return to the Google Admin Console and click “Start authentication.” This activates DKIM signing on your outgoing emails. If you receive an error, wait 10–30 minutes for DNS propagation and retry.

Step 7:

Once active, Google will show “Authenticating email with DKIM.” This means DKIM is live.

Step 8:

To verify, send an email from your domain to a Gmail account. Open the email, click the three dots (top right), and select “Show original.”
Look for the line:
dkim=pass header.i=@yourcompany.com
If you see this, DKIM is working. Your emails are now protected and more likely to reach inboxes instead of spam.

You only set up DKIM once per domain. DKIM keys rarely change, but it's a good practice to run a quick email spam test weekly or after DNS changes to catch any issues early.

Common DKIM Problems and How to Fix Them

Even a strong email security tool like DKIM can run into challenges. Here are typical issues you might face when setting up DKIM in Google Workspace, along with easy ways to resolve them.

To troubleshoot the common DKIM issues, click here.

Google Workspace DKIM With SPF and DMARC

DKIM works best when you use it together with SPF and DMARC. These three email authentication methods help protect your domain and boost email delivery.

What are SPF and DMARC?

• SPF (Sender Policy Framework) lists the servers allowed to send email from your domain. You add this as a DNS TXT record.
• DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers what to do if an email fails SPF or DKIM. It can reject, quarantine, or allow those emails. DMARC also sends you reports on email authentication results and other potential issues.

How Do They Work Together?

SPF and DKIM check different parts of your email’s path. For your messages to pass DMARC, they must pass SPF or DKIM and the domain in the “From” address must align with those checks.

If your email passes either SPF or DKIM and meets DMARC alignment rules, it’s more likely to reach the inbox. If both fail, DMARC asks the receiver to reject or quarantine the message.

Here is a quick comparison table for DKIM, SPF, and DMARC focused on what they do and how they work together in Google Workspace:

Are all three necessary?

In most cases, yes. However, DKIM plays the key role in boosting deliverability and building domain credibility, especially for Gmail and Outlook users.

If you’re setting up from the beginning, focus on implementing DKIM and SPF first, then introduce DMARC once you’re ready to track and enforce your email sending rules.

How DKIM Strengthens B2B Cold Outreach and Email Deliverability

DKIM might sound technical, but it plays a critical role in email deliverability, especially when you’re reaching out to new prospects who haven’t been contacted yet. 

Google actually suggests making sure your DKIM is set up right before launching big cold outreach campaigns because nothing kills momentum like emails vanishing into spam.

Here are some common ways DKIM helps keep your emails out of the spam folder, just like a spam tester:

1. Winning Over New Sales Leads

Imagine your sales team sending hundreds of cold emails. Without DKIM, mailbox providers might treat those emails as suspicious, resulting in bounces or spam placement. With DKIM correctly configured, your emails have a much higher chance of reaching the inbox.

2. Inviting Prospects to Events (Without Being Ghosted)

When marketers send invites to webinars or product launches, DKIM helps the email look official, like it has a stamp of approval. Otherwise, your invite risks being that annoying flyer nobody picks up.

3. Hunting for Talent

Recruiters reach out to potential candidates who haven’t applied yet. DKIM makes those “Hey, we like you!” emails less likely to be ignored or sent to spam.

4. Customer Support That Doesn’t Get Lost

Support teams sometimes reach out to assist with customer issues or to check in. DKIM plays a key role in establishing trust, so customers recognize these emails as genuine and not a prank.

Email warmup tools like MailReach can help users automate warmup and verification of DKIM records to keep outreach efforts smooth and compliant.

How MailReach Simplifies DKIM, SPF, and Deliverability Checks.

Setting up DKIM can feel complicated, but MailReach makes it simple and efficient. MailReach’s DKIM Checker gives you real-world, precise validation of your DKIM records, tested directly by Gmail to show you exactly how your emails are treated.

• Validates your DKIM, SPF, DMARC and reverse DNS
• Protects your emails by preventing spoofing and boosting trust
• Keeps you compliant with Gmail, Microsoft and Yahoo’s latest authentication rules
• Saves you time with automated daily checks during email warm-up campaigns

Check your DKIM with MailReach

To connect a Google Workspace (Gmail) account to MailReach, click here.

Improve Email Deliverability and Security with Google Workspace DKIM

Properly configuring Google Workspace DKIM is critical for reliable email delivery and brand protection in 2025. It helps prevent your emails from being marked as spam, protects against spoofing and phishing, and ensures you maintain a strong sender reputation. 

With DKIM correctly set up, your organization gets better control and visibility over email authentication, leading to higher inbox placement rates and smoother outreach campaigns. Prioritizing DKIM is a strategic decision that supports trust, security, and effectiveness in all your email communications.