Learning objective
By the end of this tutorial, you’ll know how to generate a DKIM key in the Google Admin console, publish it as a DNS TXT record in GoDaddy, and turn on DKIM signing so Gmail can authenticate messages sent from your domain.
Why this matters
DKIM (DomainKeys Identified Mail) helps prevent spoofing and phishing by adding a cryptographic signature to outbound email. When DKIM is configured correctly, receiving mail servers are more likely to trust your messages, improving deliverability and reducing the chance your emails land in spam.
Prerequisites
You have super administrator access to your Google Admin console.
You can edit DNS records for your domain in GoDaddy.
Gmail is enabled for your Google Workspace domain.
Important: After enabling Gmail for your domain, wait 24–72 hours before generating a DKIM key. If you try earlier, you may see an error like “DKIM record not created.”
Core lesson: Step-by-step workflow
Phase 1: Generate your DKIM key in Google Admin console
Sign in to your Google Admin console.
Open Gmail’s DKIM settings:
Go to Menu → Apps → Google Workspace → Gmail.
Select Authenticate email.
This is where Google Workspace creates (and later verifies) the DKIM information used to sign your outgoing mail.
Select your domain from the domain list (if you have more than one).
Generate the DKIM record:
Click Generate new record.
Choose your DKIM settings (for example, key length) based on your organization’s requirements.
Click Generate.
After you generate it, Google will show you a TXT record name/host and a TXT record value. You’ll publish these in GoDaddy in the next phase.
Phase 2: Publish the DKIM record in GoDaddy (DNS)
Log in to GoDaddy and open your domain’s management page.
Navigate to DNS settings (the area where you can add/edit DNS records).
Add a new TXT record using the values from Google Admin console:
Type: TXT
Host/Name: Enter the TXT record name (host) shown in Google Admin console.
Value/Content: Paste the DKIM TXT value shown in Google Admin console.
This step is required because receiving mail servers look up your DKIM public key in DNS to verify the signature on your emails.
Save your DNS changes in GoDaddy.
Propagation note: DNS updates can take time to propagate. It may take up to 48 hours before Google can reliably detect the new record.
Phase 3: Turn on DKIM signing in Google Admin console
Return to Google Admin console → Apps → Google Workspace → Gmail → Authenticate email.
Click Start authentication.
This tells Google Workspace to begin signing outgoing email with DKIM for that domain.
Practical application / real-life example
If you send customer communications (for example, invoices, password resets, newsletters, or sales outreach) from [email protected], DKIM helps mailbox providers confirm those messages are genuinely from your domain. After setup, recipients’ mail servers can validate the DKIM signature using the public key you published in GoDaddy, reducing spoofing risk and improving inbox placement.
Troubleshooting & pitfalls
Issue: “DKIM record not created” when generating the key
Root cause: Gmail was recently enabled for the domain, and Google hasn’t fully provisioned DKIM for it yet.
Fix: Wait 24–72 hours after enabling Gmail, then try generating the record again.
Issue: Google can’t start authentication (record not found)
Root cause: The TXT record name/value doesn’t match what Google expects, or DNS hasn’t propagated yet.
Fix:
Re-check the Host/Name and Value copied from Google Admin console.
Confirm you added the record to the correct domain in GoDaddy.
Wait up to 48 hours and try Start authentication again.
Issue: GoDaddy won’t save the TXT value (or it gets truncated)
Root cause: Some DNS UIs enforce length limits or formatting rules for TXT records.
Fix: Check GoDaddy’s requirements for long TXT records. If the value is split or auto-formatted, ensure the final saved TXT record exactly matches Google’s DKIM value (without missing characters).
Issue: You have multiple domains (or a subdomain) in Google Workspace
Root cause: DKIM is configured per domain.
Fix: Repeat the workflow for each domain you send mail from, generating a unique DKIM key and publishing each corresponding TXT record in DNS.
Knowledge check (quick self-quiz)
Did you generate the DKIM record under the correct domain in Google Admin console?
Did you publish the DKIM record as a TXT record in GoDaddy using the exact host/name and value Google provided?
After DNS propagation time, were you able to click Start authentication successfully?