In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email, generate a 2048-bit DKIM key, publish the TXT record it provides at selector google._domainkey, then click Start authentication. Allow up to 48 hours for it to activate.
Google gives you a long TXT value (often split into chunks). Create a TXT record with host google._domainkey and paste the full key as the value. If your DNS provider limits TXT length, use the chunked format they provide.
Back in the Admin console, click Start authentication. Until you do, Google signs with a default key, not yours — and DKIM won’t align to your domain for DMARC.
Check the selector record:
$ dig TXT google._domainkey.yourdomain.com +shortCheck your DKIM record now
Open the free DKIM checker →The default selector is google. You can define a custom selector prefix when generating the key.
The most common reason is forgetting to click “Start authentication” in the Admin console, or DNS not yet propagated (allow up to 48 hours).
