Setup guide
DKIM Setup for Google Workspace & Microsoft 365
DKIM setup is three steps: generate a key in your mail provider, publish it in DNS (a TXT record at google._domainkey for Google Workspace, two CNAMEs for Microsoft 365), then turn signing on. Here is each step, for each DNS host, plus fixes for DKIM fail.
- Selected domain
- northwind.io
- DKIM key bit length
- 2048
- Prefix selector
- DNS Host name (TXT record name)
- google._domainkey
- TXT record value
- v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu3…
Google Workspace
Google Workspace DKIM setup, step by step
You need super administrator access to generate the key. If you only just turned on Gmail for the domain, Google asks you to wait 24–72 hours before a key can be generated.
Step 1
Generate
Admin console › Apps › Google Workspace › Gmail › Authenticate email › Generate new record. Choose 2048-bit.
Step 2
Copy
Copy the DNS Host name (google._domainkey) and the TXT record value.
Step 3
Publish
Add a TXT record with those values at your DNS host.
Step 4
Start
Back in Authenticate email, click Start authentication.
Step 5
Verify
Email a Gmail address and look for dkim=pass in Show original.
The record Google gives you (TXT)
Host: google._domainkey
Value: v=DKIM1; k=rsa; p=<your public key>Host only accepts 255 characters?
DNS hosts
Add the DKIM record at GoDaddy, Cloudflare, Namecheap or Squarespace
Enter only the selector part as the host. Most DNS hosts add your domain automatically, so typing the full name can create google._domainkey.northwind.io.northwind.io.
| DNS host | Where to add it | Host field | Value field |
|---|---|---|---|
| GoDaddy | Domain Portfolio › your domain › DNS › Add New Record › Type: TXT | google._domainkey | Value |
| Cloudflare | DNS › Records › Add record › Type: TXT | google._domainkey | Content |
| Namecheap | Domain List › Manage › Advanced DNS › Add New Record › TXT Record | google._domainkey | Value, then Save all changes |
| Squarespace (incl. former Google Domains) | Domains › your domain › DNS › DNS Settings › Custom Records › Add record › TXT | google._domainkey | Text |
- GoDaddy: the DNS editor only applies if the domain uses GoDaddy's nameservers. Otherwise add the record wherever your nameservers point.
- Cloudflare: TXT records are DNS-only; there is no proxy setting to worry about.
- Namecheap: new records normally take effect within about 30 minutes.
- Squarespace: if you bought the domain through Google Workspace, manage its records in the Google Admin console instead.
Check the record is live
dig TXT google._domainkey.northwind.io +shortPrefer not to use a terminal? Enter your domain and selector in the DKIM checker instead.
Microsoft 365
Microsoft 365 DKIM: selector1 and selector2 CNAMEs
Microsoft 365 doesn't DKIM-sign mail from a custom domain until you set it up. Instead of a TXT key, you publish two CNAME records that point at keys Microsoft hosts for you.
- In the Microsoft Defender portal, go to Email & collaboration › Policies & rules › Threat policies › Email authentication settings and open the DKIM tab.
- Try to turn on the toggle for your domain. The status changes to
CnameMissing; open the domain to copy the two values under Publish CNAMEs. - Create both CNAME records at your DNS host. Microsoft can take a few minutes, or longer, to detect them.
- Turn on Sign messages for this domain with DKIM signatures. The status should read “Signing DKIM signatures for this domain”.
Format for domains added since May 2025 (copy your exact values from the portal)
selector1._domainkey CNAME selector1-northwind-io._domainkey.<tenant>.<x>-v1.dkim.mail.microsoft
selector2._domainkey CNAME selector2-northwind-io._domainkey.<tenant>.<x>-v1.dkim.mail.microsoftOlder domains keep the previous format
selector1._domainkey CNAME selector1-northwind-io._domainkey.<tenant>.onmicrosoft.comPrefer PowerShell? Get-DkimSigningConfig -Identity northwind.io | Format-List Selector1CNAME,Selector2CNAME prints the exact values.
Selectors
What is a DKIM selector?
The selector is the name of one specific key. It lets a domain run several keys side by side: one per sending service, or an old and new key during rotation.
How a receiver uses the DKIM selector
The s= and d= tags in the signature tell it exactly where your public key lives.
That is why Google Workspace publishes at google._domainkey and Microsoft 365 at selector1._domainkey and selector2._domainkey, and why two services can both sign for your domain without clashing. If a service asks you to use a selector that already exists, pick a different prefix.
Troubleshooting
DKIM fail: causes and fixes
| What you see | Likely cause | Fix |
|---|---|---|
| Admin console says “Not authenticating” | The record was added but signing was never started. | Click Start authentication. |
dkim=fail (body hash did not verify) | Something changed the message after it was signed, such as a gateway adding a footer. | Stop the modification, or sign after it happens. |
| No DKIM result, or key not found | TXT record missing, or its value doesn't match the Admin console. | Compare the dig output with the console value character by character. |
| Host shows …northwind.io.northwind.io | The full domain was typed into the host field. | Enter only google._domainkey. |
| Key cut off in DNS | The host truncated a 2048-bit value at 255 characters. | Split into quoted strings, or use a 1024-bit key. |
| dkim=pass but DMARC fails | The message was signed by another domain in d=. | Fix DMARC alignment |
CnameMissing | Microsoft 365 can't see your CNAME records yet. | Check both records against Get-DkimSigningConfig and wait. |
Skip the DNS work entirely
DKIM is one of three records. See how it fits with the others in SPF vs DKIM vs DMARC, and set up the Google Workspace SPF record next.
Sources: Google: set up DKIM · Google: troubleshoot DKIM · Microsoft: DKIM for custom domains · RFC 6376 (DKIM) · RFC 8301 (DKIM key sizes) · GoDaddy: add a TXT record · Cloudflare: create DNS records · Namecheap: add TXT records · Squarespace: DNS records for email
Get a free DNS audit
Tell us where to send it. We'll reply with mailbox, domain and DNS recommendations for your sending volume — or start right away and have mailboxes live in minutes.
Where should we send it?
Or see pricing →Frequently asked questions
How do I set up DKIM for Google Workspace?
In the Admin console go to Apps > Google Workspace > Gmail > Authenticate email, pick your domain and click Generate new record (2048-bit, prefix google). Add the TXT record it shows at google._domainkey with your DNS host, then return and click Start authentication. Google says it can take up to 48 hours to start working.
What is a DKIM selector?
A selector is a label that lets one domain publish several DKIM keys. The sender writes it in the s= tag of the DKIM-Signature header, and the receiver fetches the public key from selector._domainkey.yourdomain.com. Google Workspace uses google by default; Microsoft 365 uses selector1 and selector2.
How do I add a DKIM record in GoDaddy?
In your Domain Portfolio, open the domain, go to DNS and choose Add New Record. Set Type to TXT, Name to google._domainkey (or the host your provider gives you), paste the v=DKIM1 value into Value and save. This only works if the domain uses GoDaddy's nameservers.
Why is DKIM failing?
The most common causes are: signing was never started in the Admin console, the TXT record is missing or doesn't match the key, the host name has your domain added twice, or something modified the message after it was signed. A result of "body hash did not verify" means the message was changed in transit.
Should I use a 1024-bit or 2048-bit DKIM key?
Use 2048-bit whenever your DNS host accepts it. RFC 8301 says signers should use keys of at least 2048 bits. Google offers 1024-bit only for DNS hosts that can't store the longer key.
Where does google._domainkey come from?
It is the DNS name where Google Workspace publishes your DKIM public key: the default selector google, followed by ._domainkey. Receivers look it up as google._domainkey.yourdomain.com.