DKIM Setup Guide: How to Enable DKIM for Google Workspace, Microsoft 365, and More

Setting up DKIM requires access to two things: your email provider's admin panel (to generate the DKIM key pair and enable signing) and your DNS provider (to add the public key as a TXT record).

The process is the same for every provider: generate keys, copy the public key to DNS, enable signing, verify.

1. 1

   Generate DKIM key pair in your ESP

   Log into your email provider's admin console. For Google Workspace: Admin → Gmail → Authenticate email. For Microsoft 365: security.microsoft.com → DKIM. Generate a 2048-bit key.

2. 2

   Copy public key to DNS

   Your provider gives you a DNS record name (e.g., google._domainkey.yourdomain.com) and a TXT value. Add this as a TXT record in your DNS provider. Microsoft 365 uses CNAME records instead of TXT.

3. 3

   Enable DKIM signing

   After DNS propagates (1-48 hours), return to your provider's admin console and enable DKIM signing. The provider will verify the DNS record is present before activating.

4. 4

   Verify signing is active

   Send a test email to a Gmail account. Open the email → Show original. Look for 'signed-by: yourdomain.com' and dkim=pass in the Authentication-Results header.

5. 5

   Repeat for each sending service

   Every ESP, CRM, or tool that sends email on your behalf needs its own DKIM key. Each service uses a different selector (e.g., google, selector1, s1, k1).

1. Open the Google Admin console (admin.google.com) 2. Go to Apps → Google Workspace → Gmail → Authenticate email 3. Click 'Generate new record' — choose 2048-bit key length 4. Copy the TXT record name and value 5. Add the TXT record to your DNS at google._domainkey.yourdomain.com 6. Return to Google Admin and click 'Start authentication' 7. Verify by sending a test email and checking the DKIM-Signature header

Google may take up to 48 hours to begin signing after you enable authentication.

1. Go to the Microsoft 365 Defender portal (security.microsoft.com) 2. Navigate to Email & collaboration → Policies & rules → Threat policies → DKIM 3. Select your domain and click 'Create DKIM keys' 4. Microsoft shows two CNAME records to add to your DNS (selector1._domainkey and selector2._domainkey) 5. Add both CNAME records to your DNS 6. Return to the DKIM page and enable DKIM signing 7. Wait for propagation and click 'Enable' when DNS records resolve

Microsoft 365 uses CNAME records (not TXT) for DKIM — make sure you're adding CNAME records, not TXT.

1. In SendGrid, go to Settings → Sender Authentication → Domain Authentication 2. Click 'Authenticate Your Domain' and select your DNS provider 3. Enter your domain and configure your branding settings 4. SendGrid provides two CNAME records to add to your DNS 5. Add the CNAME records in your DNS provider 6. Return to SendGrid and click 'Verify' once DNS propagates 7. SendGrid will show 'Verified' when DKIM is active

SendGrid uses CNAME records that point to SendGrid's infrastructure — this enables automatic key rotation when SendGrid rotates their keys.

Send a test email to a Gmail or Yahoo account you control, then:

1. Open the email in Gmail 2. Click the three-dot menu → Show original 3. Look for 'signed-by: yourdomain.com' in the email details section 4. In raw headers, find Authentication-Results — it should show dkim=pass

Alternatively, use an email analyzer tool or DKIM checker that verifies signatures by fetching your public key from DNS and validating against the signature in the email headers.