--- title: "Is Your Google Workspace DKIM Setup Broken? | DMARC Report" description: "Deploying and configuring DKIM on Google Workspace is a two-step process, and administrators often skip the second step." image: "https://dmarcreport.com/og/blog/is-your-google-workspace-dkim-setup-broken.png" canonical: "https://dmarcreport.com/blog/is-your-google-workspace-dkim-setup-broken/" --- Quick Answer Deploying and configuring DKIM on Google Workspace is a two-step process, and administrators often skip the second step. In such cases, DKIM and DMARC function properly, and email delivery is not impacted either. However, DKIM doesn’t authenticate emails using your custom domain. Related: [Free DMARC Checker](/tools/dmarc-checker/) ·[How to Create an SPF Record](/tools/spf-record-generator/) ·[SPF Record Format](/blog/spf-format-checker-dos-and-donts-for-email-authentication/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fis-your-google-workspace-dkim-setup-broken%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Is%20Your%20Google%20Workspace%20DKIM%20Setup%20Broken%3F&url=undefined%2Fblog%2Fis-your-google-workspace-dkim-setup-broken%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fis-your-google-workspace-dkim-setup-broken%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fis-your-google-workspace-dkim-setup-broken%2F&title=Is%20Your%20Google%20Workspace%20DKIM%20Setup%20Broken%3F "Share on Reddit") [ ](mailto:?subject=Is%20Your%20Google%20Workspace%20DKIM%20Setup%20Broken%3F&body=Check out this article: undefined%2Fblog%2Fis-your-google-workspace-dkim-setup-broken%2F "Share via Email") ![Google Workspace](https://media.mailhop.org/dmarcreport/images/2024/05/how-to-create-dmarc-record-1365.jpg) ## Try Our Free DKIM Lookup Auto-discover DKIM selectors for any domain - scan 185 common selectors across all major providers. [ Discover DKIM Selectors → ](/tools/dkim-lookup/) Deploying and configuring [DKIM on Google Workspace](/blog/learning-to-setup-spf-dkim-and-dmarc-in-google-workspace/) is a **two-step process**, and administrators often skip the second step. In such cases, DKIM and [DMARC](/) function properly, and email delivery is not impacted either. _However, DKIM doesn’t **authenticate emails** using your custom domain._ Let’s see what these two steps are and how you can avoid breaking up the **Google Workspace DKIM setup**. If you haven’t already, you’ll also need to [create a DMARC record](/create-dmarc-record/) for your domain so authentication works end to end. ## Step One of Google Workspace DKIM Setup Start by generating a pair of **cryptographically secured** [public and private keys](https://www.appviewx.com/education-center/what-are-public-and-private-keys/). Then, use your DKIM record to set up DNS for the domain to serve the record under google.\_domainkeys.example.com, where you have to replace example.com with the [Google Workspace](https://en.wikipedia.org/wiki/Google%5FWorkspace) domain. ![Understanding Private Keys](https://media.mailhop.org/dmarcreport/images/2024/05/dmarc-office-365-35.jpg) _Many administrators mistakenly believe that the DKIM setup is complete after the first step_. However, it’s crucial to understand that this step alone **doesn’t enable Google to sign emails** using your domain as the **signing domain**. To achieve this, the second step is essential. ## Step Two of Google Workspace DKIM Setup _Create a [DKIM record](/topic/adding-dkim-to-dns-records/), add it to your DNS, and wait for the changes to propagate_. After that, you **must revisit** the Google Workspace and enable DKIM by clicking the ‘**Start Authentication**’ button. A quick [DKIM lookup](/tools/dkim-lookup/) confirms whether your record is published and serving the right key. ## What About DMARC? _Most domain owners or admins don’t realize that Google is not signing emails with their domains, as DMARC works fine_. Malfunctioning of DMARC is one of the signals for **erroneous DKIM and SPF settings**, but in the case of Google Workspace, this indicator doesn’t blink. Two reasons why DMARC works fine in this condition are- 1. [SPF records](/topic/creating-an-spf-record/) generally include the **\_spf.google.com** domain, which is why emails pass SPF authentication checks. 2. _By default, Gmail uses the **sender address** on the ‘Envelope-From header,’ which validates that the ‘Envelope-From’ and [‘From’ domains](https://www.icontact.com/define/email-domain/#:~:text=An%20email%20domain%20is%20the,domain%20names%20for%20their%20employees.) are the same._ Because of these two reasons, the [SPF](/dmarc-fundamentals/what-is-spf/) gets aligned, even if **DKIM doesn’t**, and _to clear DMARC checks, only one of the protocols has to pass_. If the distinct roles of these three protocols are unclear, our guide to [SPF vs DKIM vs DMARC](/blog/spf-vs-dkim-vs-dmarc-difference-explained-2026/) breaks down how each one contributes to alignment. ## Why Should You Fix the Issue? Some specific [Google applications](https://en.wikipedia.org/wiki/List%5Fof%5FGoogle%5Fproducts) don’t use your domain in the ‘Envelope-From’ header of the outgoing emails. Instead, they use your domain in the **‘From’ header**, and a [Google domain](https://en.wikipedia.org/wiki/Google%5FDomains) is used in the ‘Envelope-From’ address. In this case, **SPF alignment won’t happen** from a DMARC perspective. As a result, emails sent from these applications will fail [DMARC checks](/dmarc-record-check/) unless DKIM is configured and enabled in Google Workspace. ![authorized email](https://media.mailhop.org/dmarcreport/images/2024/05/dmarc-check-5365.jpg) You may understand this better with the [Google Calendar invite example](https://ccp.com.au/google-calendar-problem-with-dmarc/), where even if the emails carry your domain in the ‘From’ address, the ‘Envelope-From’ line points to calendar-server.bounces.google.com. _Given this setup, [SPF alignment](/topic/spf-dkim-alignment-defined/) always fails, leaving DMARC dependent solely on DKIM for a pass_. However, if [DKIM](/dmarc-fundamentals/what-is-dkim/) is not initiated, **DKIM alignment will also fail**, resulting in DMARC failure. Should this occur with a strict DMARC policy (e.g., p=reject), these confirmation emails will be outright **rejected**. ## What Happens if you Start DKIM Authentication on an Existing Domain? If you properly follow the steps mentioned above, there won’t be any adverse effects. However, to be safe, it’s better if you change your [DMARC policy](/lessons/defining-a-dmarc-policy/) to ‘**quarantine’ instead of ‘reject**.’ _This way, instances of [false positives](https://www.nospamproxy.de/en/what-is-a-false-positive-and-what-is-a-false-negative/) won’t dump your conversations outright_. ## Topics [ dkim ](/tags/dkim/)[ DMARC ](/tags/dmarc/)[ SPF ](/tags/spf/) ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fis-your-google-workspace-dkim-setup-broken%2F) [ ](https://twitter.com/intent/tweet?text=Is%20Your%20Google%20Workspace%20DKIM%20Setup%20Broken%3F&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fis-your-google-workspace-dkim-setup-broken%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fis-your-google-workspace-dkim-setup-broken%2F) Copy Related Articles - [ ![use dmarc p none policy](https://media.mailhop.org/dmarcreport/images/2024/11/gmail-dmarc-7904.jpg) 4 situations in which you should use the DMARC’s p=none policy Uncategorized ](/blog/4-situations-when-to-use-dmarc-p-none-policy-effectively/) - [ ![email security with DMARC policy](https://media.mailhop.org/dmarcreport/images/2026/01/dmarc-report-80907.jpg) 5 situations in which your DMARC policy should be ‘p=quarantine’ Uncategorized ](/blog/5-situations-when-your-dmarc-policy-should-use-p-quarantine/) - [ ![dmarc check](https://media.mailhop.org/dmarcreport/images/2026/05/dmarc-analyzer-6921.jpg) Advanced DMARC Check Methods To Detect Authentication Failures Uncategorized ](/blog/advanced-dmarc-check-methods-to-detect-authentication-failures/) - [ ![CRM Platforms for Email Marketing](https://media.mailhop.org/dmarcreport/images/2026/05/what-is-dmarc-6009.jpg) Best CRM Platforms for Email Marketing Success Uncategorized ](/blog/best-crm-platforms-for-email-marketing-success/) ## Related Articles [ Uncategorized 3m 4 situations in which you should use the DMARC’s p=none policy Nov 13, 2024 ](/blog/4-situations-when-to-use-dmarc-p-none-policy-effectively/)[ Uncategorized 6m 5 situations in which your DMARC policy should be ‘p=quarantine’ Jan 9, 2026 ](/blog/5-situations-when-your-dmarc-policy-should-use-p-quarantine/)[ Uncategorized 12m Advanced DMARC Check Methods To Detect Authentication Failures May 4, 2026 ](/blog/advanced-dmarc-check-methods-to-detect-authentication-failures/)[ Uncategorized 8m Best CRM Platforms for Email Marketing Success May 12, 2026 ](/blog/best-crm-platforms-for-email-marketing-success/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Is Your Google Workspace DKIM Setup Broken?","description":"Deploying and configuring DKIM on Google Workspace is a two-step process, and administrators often skip the second step.","url":"https://dmarcreport.com/blog/is-your-google-workspace-dkim-setup-broken/","datePublished":"2024-05-02T18:05:51.000Z","dateModified":"2025-06-11T13:22:42.000Z","dateCreated":"2024-05-02T18:05:51.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/is-your-google-workspace-dkim-setup-broken/"},"articleSection":"uncategorized","keywords":"dkim, DMARC, SPF","wordCount":550,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/images/2024/05/how-to-create-dmarc-record-1365.jpg","caption":"Google Workspace","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Uncategorized","item":"https://dmarcreport.com/uncategorized/"},{"@type":"ListItem","position":4,"name":"Is Your Google Workspace DKIM Setup Broken?","item":"https://dmarcreport.com/blog/is-your-google-workspace-dkim-setup-broken/"}]} ```