How to set up DKIM for Google Workspace.

Go to Admin console → Apps → Google Workspace → Gmail → Authenticate email. Click Generate new record, choose 2048-bit, and click Generate. Google displays the TXT record value — this is the public key you publish at google._domainkey.your-domain.com. After publishing, return to the same screen and click Start authentication to tell Google to begin signing outbound mail.

Google Workspace uses a fixed selector name (google) for all customers, which means your DKIM record is always at google._domainkey.your-domain.com. Unlike Microsoft 365 (which uses rotating selectors) or SendGrid (which uses account-specific selectors), you only ever need one DKIM record for Google Workspace.

Go to Admin console → Gmail → Authenticate email → Generate new record. Generating a new key does not immediately replace the old one — it creates a new key waiting to be published. Update the DNS TXT record at google._domainkey with the new value, wait for DNS propagation, then click Start authentication again. Old signatures from the previous key remain valid until they expire (typically 7 days).

Common causes: (1) DNS propagation hasn't completed — wait 30–60 minutes and re-test, checking from an external resolver like 8.8.8.8; (2) you published the record but haven't clicked Start authentication in the Admin console; (3) the TXT value was truncated during copy-paste — the key is long and some DNS editors silently cut it. Use the DKIM checker at mailermonk.com/tools/dkim-checker to verify the published key resolves correctly.