◎ExposureCheck

Email security · checked 17 October 2026

How to set up DKIM in Google Workspace and Microsoft 365

DKIM adds a signature to every email you send so receivers can check it really came from your domain and wasn't changed. Google Workspace and Microsoft 365 both support it, but neither signs with your domain until you turn it on and add a DNS record.

Google Workspace

  1. Sign in to the Google Admin console as an admin and go to Apps → Google Workspace → Gmail → Authenticate email.
  2. Pick your domain and click Generate new record. Choose a 2048-bit key unless your DNS host can't store long records, and keep the default prefix google.
  3. Copy the TXT record name (google._domainkey) and value.
  4. At your DNS host, add a TXT record with that name and value.
  5. Back in the Admin console, click Start authentication. If it says the record isn't found, wait and try again; DNS changes can take up to 48 hours.

Microsoft 365

  1. Go to the Microsoft Defender portal and open Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
  2. Select your custom domain. Microsoft shows two CNAME records, for selector1._domainkey and selector2._domainkey.
  3. Add both CNAME records at your DNS host, copying the targets exactly as Microsoft shows them.
  4. Back in the portal, switch on Sign messages for this domain with DKIM signatures. If it errors, the CNAMEs haven't spread yet; try again later.

Microsoft uses two selectors so it can rotate keys without breaking your mail.

Don't forget your other senders

Newsletter tools, invoicing apps, CRMs and helpdesks send "from" your domain too. Each has its own DKIM setting (usually one or more CNAME records in its domain authentication page). Any service you skip will fail DMARC once you move past p=none.

Check it works

  1. Run the free check. It looks for DKIM on common selectors, including google, selector1 and selector2.
  2. Send yourself an email at a Gmail address, open it, choose Show original and look for DKIM: PASS with your domain.

Next: set up DMARC, and if your SPF fails with too many lookups, fix it here.

Sources: RFC 6376 (DKIM); Google Workspace Admin Help, "Set up DKIM"; Microsoft Learn, "Set up DKIM to sign mail from your Microsoft 365 domain". Read 17 October 2026.