How to Set Up DKIM in Gmail (Google Workspace Admin Console and DNS)

Gmail DKIM means a Google Workspace domain signs its outgoing mail with a key you publish in DNS. You generate the key in the Admin console, paste one TXT record at your DNS host, then switch signing on. This guide does that, shows the header that proves it works, and ends with a free check on the list you are about to email.

Personal @gmail.com addresses have no DKIM setting. This is for custom domains on Google Workspace.

TL;DR

• Gmail DKIM takes about 20 minutes of work. The key can take up to 48 hours to start working after you add it to DNS (Google, September 2026).
• You generate a 2048-bit key with selector google, publish google._domainkey.acme.com as TXT, click Start authentication, and read dkim=pass in a received message.
• It spends 0 LeadOcean records. The audience check is a free count.

Prerequisites

• A Google Workspace account with the Gmail Settings administrator privilege.
• Edit access to the DNS zone of your sending domain.
• A shell with dig.
• A second mailbox on Gmail or Google Workspace to receive the test. Google says you cannot verify DKIM by sending a message to yourself.
• A LeadOcean API key in $LEADOCEAN_API_KEY for Step 4. The free plan covers it.

Google makes you wait 24 to 72 hours after you turn on Gmail for a new domain before the key can be generated. Trying earlier can fail with "DKIM record was not created" (Google, September 2026).

Step 1: Generate the DKIM key in the Admin console

Pick 2048 bits and keep the selector google. Google recommends that selector on Workspace. 2048 is the right choice unless your DNS host cannot store it, in which case Google offers 1024.

In the Admin console, go to Menu, Apps, Google Workspace, Gmail, then Authenticate email. Select the domain and click Generate New Record.

Selected domain:        acme.com
DKIM key bit length:    2048
Prefix selector:        google

Click Generate. Copy the two values shown. Use one domain per key: if you send from several domains, repeat these steps for each.

DNS Host name (TXT record name):  google._domainkey
TXT record value:                 v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

If google is taken on that domain, enter another prefix, such as google2026. Check your DNS for existing keys first. A sequencer or help desk may already own one.

Step 2: Publish the TXT record at your DNS host

Add one TXT record. The host field is the selector plus ._domainkey. Most panels append the domain for you.

Type:   TXT
Host:   google._domainkey
Value:  v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...
TTL:    3600

A 2048-bit key is longer than one 255-character string. Paste the whole value and let the panel split it. If it rejects the length, check whether it adds the quote marks itself.

Then query it from your own machine:

dig +short TXT google._domainkey.acme.com

"v=DKIM1; k=rsa; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

An empty answer means the name is wrong or has not propagated. A doubled name such as google._domainkey.acme.com.acme.com is the usual cause, and it comes from a panel that appends the zone to a full name.

The Admin console may keep saying "You must update the DNS records for this domain" for up to 48 hours. If dig returns your key, ignore it (Google, September 2026).

Step 3: Start authentication and read the header

Go back to Authenticate email, select the domain and click Start authentication. When it works, the status at the top reads "Authenticating email with DKIM".

Now send a message from your domain to a different Gmail or Workspace mailbox. Open it, click More next to Reply, then Show original. Find the Authentication-Results line.

Authentication-Results: mx.google.com;
       dkim=pass header.i=@acme.com header.s=google header.b=Ab12Cd34;
       spf=pass smtp.mailfrom=acme.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=acme.com

header.i is the signing domain. header.s is your selector. If both name your domain and google, the signature is yours and it verifies. This block uses placeholder values.

Read the three results together. DKIM proves the message was signed by your domain. SPF checks the sending server. DMARC checks that one of them aligns with the visible From address, so a pass on all three is the target.

If the header has no DKIM line at all, the message was not signed. Confirm Step 3 finished, wait for the 48-hour window, and send again. Related reading: SPF setup, the full DKIM guide for any sender and what DKIM is.

Step 4: Size the list you will send to

Authentication gets mail accepted. It does not make a stale list safe to send to. A list full of bad addresses still damages the reputation you just set up, so count before you export. This call is free and reads no records.

curl -s -X POST "https://api.leadocean.io/v1/people/search?count=true&limit=1" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jobFunction": ["Sales & Business Development"],
    "country": ["US"],
    "emailStatus": ["verified"]
  }' | jq '.meta'

count=true and limit=1 go in the query string, not the body. The body is flat JSON and every filter is an array. The same count is available as the free MCP tool leadocean_count_leads. A count of verified addresses is not a mailable list: it excludes catch-all domains, which the default mailable count includes.

What you get

The same filters, run through the free MCP tool leadocean_count_leads on 2026-10-21. It cost 0 records.

{
  "total": 801741,
  "totalIsExact": true,
  "distinctCompanies": 165445,
  "credits": 0,
  "source": "leadocean"
}

That is 801,741 people with jobFunction Sales & Business Development, country US and emailStatus verified, across about 165,445 employers (an estimate above 40,000). The REST call caps meta.total at 100,000, so it returns 100,000 with totalIsExact false for an audience this wide. Add title, seniority or industry filters to narrow it. Two checks, two proofs. The header from Step 3 proves the domain is signed. This count proves the audience exists before you spend a record on it. Run it again whenever you change a filter. It is free every time.

Troubleshooting

A 402 means the 1,000 free records are spent. Counts never cause it.

FAQ