Domain Search
AI Domain Search
Domain Transfer
TLD List with Prices
SSL Certificates
Create a Website
Google Workspace
News
Podcast
Promos
About Us
Contact
Google Workspace DKIM signs outgoing mail from your domain. Generate the key in Google Admin, publish its exact TXT name and value in the DNS service that hosts your domain, then start authentication and check a message header. This NicNames guide covers the DNS fields and the checks to make before changing an existing record.
1. Generate the key in Google Admin
Sign in to Google Admin as a super administrator. Open Apps → Google Workspace → Gmail → Authenticate email, select the sending domain, and choose Generate New Record. Google says a newly enabled Gmail service may need 24–72 hours before a DKIM key can be generated.
Choose a 2048-bit key if your DNS host can accept it; Google recommends the longer option where supported. The default selector is google. If that selector already belongs to another active DKIM key, choose a different one instead of replacing a working record without a plan. Copy the DNS Host name (TXT record name) and TXT record value from Google Admin. Do not use a sample key from a tutorial. Wait to click Start authentication until after the DNS record is published.
2. Add the TXT record in the active DNS zone
In NicNames, open ClassicDNS, select the domain, and check its Name-Servers. If it uses NicNames Free Name-Servers, open DNS Records → Manage. If it uses custom nameservers, add the record at the DNS provider named by those servers instead. A record saved in an inactive zone will not change the public DNS answer.
Choose + Add record and select TXT. In Name, enter the host name Google supplies, normally the selector followed by ._domainkey, in the format the NicNames editor expects for this domain. In Text, paste the entire TXT value exactly as Google shows it, including the public-key portion. Check that the editor has not truncated the value. Keep the displayed TTL unless your mail administrator has a reason to change it. Review the name, type and text, then save once. If a TXT record already exists at the same selector, confirm what uses it before editing.
Google Workspace DKIM signs outgoing messages; it does not replace Google Workspace MX records for incoming mail or your existing SPF record. Preserve unrelated MX, SPF and other TXT entries.
3. Start authentication and check a real message
After the public TXT answer shows Google's full value, return to Authenticate email in Google Admin, select the same domain and click Start authentication. Google's working status reads Authenticating email with DKIM. Google notes that setup can take up to 48 hours after adding the key; a delay alone is not a reason to generate another key.
Send a test message to a different Gmail or Google Workspace account, open its Show original view, and check Authentication-Results for dkim=pass. Google cautions against using a message sent to yourself as the verification test. If your organization also sends through another platform, that sender needs its own authentication review; this Google key does not automatically cover it. Our DMARC record check explains how the From domain and authentication results fit together.
4. If the check fails, inspect before replacing
Compare the selected Google Admin domain, selector, full TXT value and active nameservers with the public DNS answer. The record's Name should resolve under the intended domain exactly once; a duplicated domain suffix or missing ._domainkey will point the lookup elsewhere. Check the public answer before changing the record again. The DNS troubleshooting checklist helps separate an incorrect answer from a cached one.
If the NicNames editor will not accept the full value or an existing selector is already in use, contact NicNames Support before overwriting anything. Google Workspace administrators should also review Google's DKIM status and sending configuration. Do not remove a working DKIM key or tighten a DMARC policy solely because one new test failed.
