DKIM and DMARC for Google Workspace

Set them up in this order: SPF first (see the SPF guide), then DKIM, then DMARC starting at p=none. SPF lists who may send for your domain, DKIM signs each message, and DMARC tells receiving servers what to do when a message fails both.

Turn on DKIM in Google Admin

1. Sign in to the Admin console as a super administrator. After Gmail is turned on for the domain, Google says to wait 24 to 72 hours before the key can be generated.
2. Go to Apps > Google Workspace > Gmail and open Authenticate email.
3. Select your domain and click Generate New Record. Choose a key length of 2048 bits if your DNS host supports it, otherwise 1024. Keep the default prefix selector, google, unless your domain already has a key with that name.
4. Copy the two values shown: the host name (google._domainkey) and the TXT value, which starts with v=DKIM1; k=rsa; p=.
5. At your DNS host, add a TXT record with that host name and value. If the host rejects the long value, check its help for how it handles long TXT records.
6. Wait until the record is live (up to 48 hours), then return to Authenticate email and click Start authentication. The status changes to “Authenticating email with DKIM”.

To confirm it, send a message to a Gmail address that is not your own. In the recipient’s message headers, the Authentication-Results line should show a DKIM pass. Emailing yourself does not prove it.

Add the DMARC record

DMARC needs no change in the Admin console. You add one TXT record at your DNS host, with the host name _dmarc. Google advises turning on SPF or DKIM first and letting them run for at least 48 hours, and creating a group or dedicated mailbox for the reports before you start.

• v=DMARC1 marks the record as DMARC and must come first.
• p=none is the policy. It asks receivers to take no action on failures, so you can read the reports before you enforce anything.
• rua=mailto:... is where daily summary reports go. Use a group or a dedicated mailbox, not a personal inbox: the reports can be frequent.

Move from none to quarantine to reject

Once the reports show that all of your legitimate mail passes, you can tighten the policy to quarantine and later to reject. You can raise the pct tag step by step up to 100 to apply it to a growing share of failing mail. Go slowly: a strict policy blocks your own mail if a sender you forgot, such as a CRM or a newsletter tool, is not set up for the domain.

Check both records

Use the DKIM checker with the selector google, and the DMARC checker. The domain check looks at SPF, DKIM, DMARC and MX in one run, and the DMARC record generator builds the record for you.

Common mistakes

• Clicking Start authentication before the DNS record is live. Wait until the record shows up.
• Testing by emailing yourself. Send to another Gmail address and read its headers.
• Two DMARC records. A domain has one.
• The wrong host. The DMARC host is _dmarc, not the root of the domain.
• A reports address nobody reads. The reports are how you know it is safe to tighten the policy.
• Jumping straight to reject. Start at p=none.

Why it matters now

Google’s email sender guidelines ask every sender to set up SPF or DKIM. Bulk senders, meaning more than 5,000 messages a day to Gmail addresses, need SPF, DKIM and DMARC, one-click unsubscribe, and a spam rate below 0.30% in Postmaster Tools (Google recommends staying under 0.10%). Read the rules on Google’s sender guidelines page.