How do I set up DKIM on G Suite for outgoing mail, especially when using multiple email services?
Matthew Whittaker
Co-founder & CTO, Suped
Published 22 May 2025
Updated 15 Aug 2025
7 min read
Setting up DKIM for outgoing mail in Google Workspace is a critical step for ensuring your emails are authenticated and reach their intended recipients. When you also use other email services (ESPs) like Mailgun or SendGrid alongside Google Workspace, the process can become a bit more nuanced. The goal is to ensure all your legitimate sending sources are properly authorized to send mail on behalf of your domain, preventing spoofing and improving your overall email deliverability. This guide will walk you through the necessary steps and considerations to achieve a robust DKIM setup across all your sending platforms.
Email authentication protocols like DKIM, SPF, and DMARC are fundamental in today's email ecosystem. They help receiving mail servers verify that an email truly originated from the domain it claims to be from and that it hasn't been tampered with in transit. Without proper authentication, your emails are much more likely to be flagged as spam or rejected outright, leading to significant deliverability issues.
Understanding DKIM authentication for Google Workspace
DomainKeys Identified Mail (DKIM) adds a digital signature to your outgoing emails. This signature is generated using a private key that resides on your sending server (in this case, Google's mail servers). Receiving mail servers then use a corresponding public key, which you publish as a DNS TXT record, to verify the signature. If the signature is valid, it confirms that the email has not been altered since it was signed and that it was sent by an authorized sender for your domain.
For Google Workspace, setting up DKIM for your primary domain (the one associated with your Google Workspace account) is a straightforward process within the Admin console. Google provides specific instructions to set up DKIM which involves generating a unique DKIM key for your domain.
It is important to understand that while Google Workspace automatically validates inbound DKIM signatures, you must manually configure outbound signing. This distinction is crucial, especially when you have other email sending services that also need to authenticate their outgoing mail on behalf of your domain. Proper configuration helps prevent your emails from landing in spam folders and protects your domain's reputation.
Step-by-step DKIM setup for Google Workspace
To enable DKIM for your outgoing emails sent through Google Workspace, you'll need to navigate through your Google Admin console. The general steps involve generating a DKIM record and then adding it to your domain's DNS settings. This record will typically be a TXT record that contains your public DKIM key.
Generating your DKIM record in Google Workspace
Sign in: Go to your Google Admin console (admin.google.com).
Navigate: From the Admin console Home page, go to Apps > Google Workspace > Gmail.
Authenticate email: Scroll down and click on 'Authenticate email'.
Generate key: Select your domain from the dropdown menu (if you have multiple), then click 'Generate new record'. You'll be given a DKIM host name (selector) and the TXT record value.
Once you have the host name (selector, usually google._domainkey) and the TXT record value from Google Workspace, you'll need to add this as a TXT record in your domain's DNS settings. This is typically done through your domain registrar or DNS hosting provider.
Access your domain's DNS management interface (e.g., GoDaddy, Cloudflare, Namecheap). Look for an option to add a new DNS record, select 'TXT' as the record type, and then input the host name and TXT value provided by Google. Ensure there are no extra spaces or characters.
After adding the record, return to the 'Authenticate email' section in your Google Admin console and click 'Start authentication'. DNS changes can take some time to propagate, so it might not work immediately. You may need to check back later and click 'Start authentication' again to activate it.
Managing DKIM with multiple email services
The complexity arises when you use Google Workspace for your day-to-day email but also leverage other Email Service Providers (ESPs) for marketing, transactional, or specific application-based emails. Each ESP, such as Mailgun or SendGrid, requires its own DKIM setup to sign emails sent through their infrastructure. It is essential to configure DKIM for all sending services that use your domain.
To avoid conflicts, each email service will provide you with a unique DKIM selector. For example, Google Workspace might use google._domainkey, while Mailgun might use mg._domainkey. Each of these selectors corresponds to a different public key that you will add as a TXT record in your DNS. This way, both Google and your other ESPs can sign emails with their respective keys without interference.
Google Workspace DKIM
Primary use: For emails sent directly from Gmail or other Google Workspace services.
Selector: Typically google._domainkey.
Configuration: Managed within the Google Admin console, then published in your domain's DNS.
Third-party ESP DKIM
Primary use: For marketing, transactional, or application-generated emails (e.g., Mailgun, SendGrid).
Selector: Varies by provider, often s1._domainkey, k1._domainkey, etc.
Configuration: Generated within the ESP's settings, then published in your domain's DNS.
For optimal email deliverability and to pass DMARC alignment checks, it's generally best practice for the DKIM signing domain (d=) to align with your email's From: domain. If you are using subdomains for different sending purposes (e.g., marketing.yourdomain.com), you should also set up DKIM for those subdomains through the respective ESPs. This ensures consistent authentication across all your sending streams.
Verifying your DKIM setup and troubleshooting common issues
After setting up DKIM records for Google Workspace and any other email services, it's crucial to verify their correct implementation. You can send a test email to a service that provides detailed authentication results. This will show you if the DKIM signature is present and valid.
Beyond initial setup, ongoing monitoring is key to maintaining strong email deliverability. DNS record changes, platform updates, or even slight misconfigurations can lead to DKIM failures. Regularly checking your authentication status helps you proactively address any issues that may arise.
Common DKIM setup issues
DNS propagation: It takes time for DNS changes to update globally. If DKIM isn't verifying immediately, wait a few hours and retest.
Incorrect record: Double-check for typos or incorrect values in your TXT record. Even a single misplaced character can cause failure.
Multiple records: Ensure each service has its own unique selector and that you haven't accidentally overwritten an existing record. This is especially important for troubleshooting DKIM issues.
DMARC reports: Regularly review your DMARC reports to identify any DKIM failures. These reports provide invaluable insight into your email authentication status and sources of unauthenticated email.
It's also worth noting the distinction between configuring DKIM for *outgoing* mail (which this guide focuses on) and configuring your email system to *check DKIM for incoming* mail. While Google Workspace automatically validates inbound DKIM signatures, some organizations might have specific internal policies or additional layers of security that require manual configuration to check DKIM for incoming messages.
Views from the trenches
Best practices
Always use a unique DKIM selector for each email sending service to avoid conflicts and ensure proper signing.
Prioritize DMARC alignment by ensuring your DKIM signing domain matches your email's From: domain.
Regularly monitor your DMARC reports to detect any DKIM authentication failures across all sending sources.
Set up DKIM for all domains and subdomains used for sending email, not just your primary domain.
Common pitfalls
Conflating DKIM setup for outgoing mail with incoming mail validation within G Suite.
Forgetting that DNS changes require propagation time, leading to premature troubleshooting efforts.
Overwriting existing DKIM records when adding new ones for different email service providers.
Assuming DKIM is automatically configured for all sending paths when integrating new email services.
Expert tips
Ensure your DNS records are correctly published and propagated after generating new DKIM keys.
If using subdomains for sending, configure separate DKIM records for each through their respective ESPs.
A well-configured DMARC policy, in conjunction with SPF and DKIM, significantly enhances email security.
Double-check the host name and TXT value provided by your email service provider to prevent typos.
Expert view
Expert from Email Geeks says you will want to sign with subdomains, or use two-part selectors, so the various services do not interfere with each other, but it is a standard practice.
2020-10-20 - Email Geeks
Expert view
Expert from Email Geeks says if the plan is to use DMARC in the future, it's beneficial to consider it now to ensure signing with DMARC aligned domains, which is not difficult to achieve.
2020-10-20 - Email Geeks
Ensuring email authenticity and deliverability
Properly setting up DKIM for your Google Workspace domain and any other email services you use is a non-negotiable step for modern email deliverability. It strengthens your email security posture, reduces the likelihood of your legitimate emails being flagged as spam, and builds trust with receiving mail servers.
By following these steps and ensuring each sending source has its unique DKIM signature published, you create a robust authentication framework. Remember to regularly review your DMARC reports and perform occasional checks to confirm your DKIM records are still valid and propagating correctly.
: Select your domain from the dropdown menu (if you have multiple), then click 'Generate new record'. You'll be given a DKIM host name (selector) and the TXT record value.
: For emails sent directly from Gmail or other Google Workspace services.
Mailgun, 
SendGrid).
