DKIM (DomainKeys Identified Mail) attaches a digital signature to outgoing email, generated from a private key Google holds and a matching public key published in your domain’s DNS. Receiving servers use the public key to confirm the message genuinely came from your domain and was not altered in transit.
Three separate steps
Configuring DKIM in Google Workspace involves three distinct actions, and missing any one of them leaves DKIM non-functional: generating the key in the Admin Console, publishing the resulting TXT record to your DNS under the exact selector Google provides, and then returning to the Admin Console to explicitly turn authentication on. Generating the key does not turn it on by itself.
Give it time
Google recommends waiting a period after publishing the DNS record before activating DKIM, to allow propagation to complete. Turning it on too early, before the record is publicly resolvable, can cause a temporary authentication gap.
How to confirm it is working
Send a test email to an external address and inspect the full message headers. A properly configured DKIM setup will show a clear pass result for the signature check, tied to your domain.