Google Workspace DKIM Problem

Emails are not being DKIM-signed, or a recipient’s mail server reports a DKIM verification failure.

• DKIM key generated in the Admin Console but never published to DNS
• DKIM authentication not turned on after the key was published
• Selector (the record name Google uses) copied incorrectly
• Propagation delay after publishing the record

We check whether a DKIM key has actually been generated, confirm the exact selector and value published in your DNS, and verify authentication is switched on in the Admin Console — all three steps are required, and it is easy to miss one.

1. In the Admin Console, confirm a DKIM key has been generated for your domain.
2. Copy the exact selector and TXT value shown, and confirm it matches what is published in DNS.
3. Return to the Admin Console and turn on DKIM authentication (this is a separate step from generating the key).
4. Send a test email and check the message headers for a DKIM pass result.

If the record is published, propagation has had time to complete, and authentication is still failing, the selector or key may be mismatched — worth a second look before regenerating the key.