How to Set Up DKIM for Google Workspace, Microsoft 365, and Mailchimp

What DKIM actually does

When you send an email, your email service adds a digital signature to the message header. The signature is created using a private key stored securely by your email provider. Your DNS record contains the corresponding public key.

When a receiving mail server gets your email, it:

• Reads the DKIM signature from the email header
• Looks up your public key in DNS (using the selector specified in the header)
• Uses the public key to verify the signature
• Confirms the email came from an authorised source and wasn't modified in transit

A DKIM record in DNS looks like this:

google._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

The google part is the selector — it identifies which key to use. You can have multiple DKIM keys with different selectors (one per email service).

Setting up DKIM in Google Workspace

Google Workspace generates a 2048-bit RSA key pair and gives you the DNS record to add.

1. Sign in to admin.google.com with your administrator account
2. Go to Apps → Google Workspace → Gmail
3. Click "Authenticate email"
4. Select your domain from the dropdown if you have multiple
5. Click "Generate new record"
6. Choose a key length of 2048 bits (strongly recommended over 1024)
7. Copy the DNS Host name (something like google._domainkey) and the TXT record value

Add a TXT record to your DNS provider:

• Name/Host: google._domainkey (or google._domainkey.yourdomain.com if your DNS requires the full domain)
• Type: TXT
• Value: The long string provided by Google
• TTL: 3600 (or "Automatic")

After saving, return to the Google Admin Console and click "Start authentication."Google will periodically check for the record. Once it propagates (up to 48 hours), the status will change to "Authenticating email."

Setting up DKIM in Microsoft 365

Microsoft 365 uses CNAME records instead of TXT records for DKIM — two of them, for redundancy. This is slightly different from other providers.

1. Go to the Microsoft 365 Defender portal at security.microsoft.com
2. Navigate to Email & Collaboration → Policies & Rules → Threat policies → Email Authentication Settings
3. Select the DKIM tab
4. Find your domain and click on it
5. Toggle "Sign messages for this domain with DKIM signatures" to Enabled
6. If the record isn't already in DNS, Microsoft will show you two CNAME records to add

The two CNAME records look like this:

selector1._domainkey.yourdomain.com → selector1-yourdomain-com._domainkey.youronmicrosoft.com selector2._domainkey.yourdomain.com → selector2-yourdomain-com._domainkey.youronmicrosoft.com

Add both CNAME records to your DNS provider. After propagation (up to 48 hours), the Defender portal will confirm DKIM is enabled and signing messages.

Setting up DKIM in Mailchimp

Mailchimp supports custom DKIM authentication through a feature called "Custom Domain Authentication" (sometimes called "Branded Links"). It's available on paid plans.

1. Log in to Mailchimp and go to Account → Settings → Domains
2. Click "Authenticate" next to your sending domain
3. Mailchimp will provide you with two DNS records to add:
   • A CNAME record for DKIM (the key record)
   • A CNAME record to verify domain ownership
4. Add both records to your DNS provider
5. Return to Mailchimp and click "Authenticate Domain"

Once Mailchimp detects the records (usually within 24 hours), your campaigns will be signed with DKIM using your own domain as the selector, rather than Mailchimp's default shared domain.

Setting up DKIM for SendGrid

SendGrid calls this "Domain Authentication." Go to Settings → Sender Authentication → Authenticate Your Domain. Select your DNS host, enter your sending domain, and SendGrid generates three DNS records:

• Two CNAME records for DKIM keys
• One CNAME record for domain verification

Add all three to your DNS provider, then return to SendGrid and click "Verify." Once verified, all emails sent through SendGrid will be signed with DKIM using your domain.

Verifying DKIM is working

After adding your DNS records and waiting for propagation:

• Send a test email to a Gmail address and view the original headers (More → Show original). Look for dkim=pass in the Authentication-Results header.
• Use MXToolbox's DKIM lookup tool: enter your domain and selector to check the record directly.
• Run an audit with InboxShield Mini — it checks your DKIM status against your live DNS.

Common DKIM setup mistakes

• Generating the key but not adding it to DNS — The most common mistake. The admin panel shows "active" but the DNS record doesn't exist.
• Adding the key to DNS but not activating it in the admin panel — Gmail's admin panel requires you to click "Start authentication" after adding the DNS record.
• Truncating the long TXT record value — Some DNS providers have character limits. If the value is too long, split it into multiple quoted strings within the same TXT record.
• Using the wrong selector in the record name — The selector prefix must exactly match what your email provider expects.