Set up DKIM for your business email

Before changing a key

Check the existing signing status and DNS records first. A failed lookup of a common selector does not prove DKIM is missing: the sender may use another name. Preserve working selectors, MX, SPF and DMARC records. A receiving mailbox or alias does not identify every service that sends your mail.

Google Workspace

1. Ask your super administrator to open Apps → Google Workspace → Gmail → Authenticate email and select the exact sending domain. If signing already works, keep the current key.
2. For a new setup, choose Generate New Record and a 2048-bit key if your DNS provider supports it. Use an unused selector. Copy the complete TXT name and value shown by Google; never reuse another domain’s key.
3. Publish that exact TXT record at your DNS provider, following its hostname format so it does not append the domain twice. Then return to Google Admin and choose Start authentication. Check that the status says Authenticating email with DKIM.

A newly enabled Gmail service can require 24–72 hours before key generation. DNS and authentication can take up to 48 hours. A provider may already have created the record; check before adding one. Google’s DKIM instructions

Microsoft 365

1. Your custom domain must already be added to Microsoft 365. In Microsoft Defender, open Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM, then select that domain.
2. If the domain shows NoDKIMKeys, switch signing on to generate its key instructions. The initial CNAME error is expected until DNS is ready; close it, open the domain details and find Publish CNAMEs. Copy both exact targets for selector1._domainkey and selector2._domainkey.
3. Publish both CNAME records, preserving unrelated records. Use the target values returned by your tenant: Microsoft assigns part of each name, so examples and values guessed from MX records are unsuitable. Keep a TTL of at least 3600 seconds.
4. Once Microsoft detects the CNAMEs, enable Sign messages for this domain with DKIM signatures and confirm the status Signing DKIM signatures for this domain. Detection can take several minutes or longer.

Microsoft’s DKIM setup and troubleshooting

Verify a message sent after activation

After DNS propagation and activation, send from each service and From address to a separate external mailbox you control, with permission to send the test. Another alias of the same mailbox is not enough; internal mail may follow a different signing path.

• Open the received message’s original headers. In DKIM-Signature, d= identifies the signing domain and s= the actual selector.
• Look for dkim=pass in the receiving service’s Authentication-Results. Check that the passing signing domain aligns with the visible From domain under your DMARC policy. A pass for the provider’s own domain alone is insufficient.
• Keep the message and observation time privately. Earlier mail is baseline evidence only. A published key alone proves neither active signing nor delivery to the inbox.

Set up DMARC for Google Workspace