MailFixIt

Google Workspace email configuration guide

Google Workspace: DKIM record not verifying

Google Workspace cannot verify the DKIM DNS record it expects, or sent mail is using a different selector or signing domain.

Problem description

A provider setup symptom may look like:

DKIM record not verifying after a provider DNS change.

Check the sending domain

What this usually means

Google Workspace cannot verify the DKIM DNS record it expects, or sent mail is using a different selector or signing domain.

Fix it

  1. Generate or view the DKIM record in the Google Admin console for the exact domain. After DNS is visible, return to the Admin console and start authentication; publishing the key alone does not enable signing.
  2. Copy the complete DKIM record name, type, and value from the provider console for the exact custom domain.
  3. Publish it in the authoritative DNS zone. Avoid a duplicated domain suffix, truncated key, proxied CNAME, or a TXT record where a CNAME was requested.
  4. Remove a stale record only when it uses the same selector and conflicts with the current value.
  5. Run provider verification, send a new message, and confirm that its DKIM-Signature uses the expected d= domain and s= selector.

Common mistake

A public key can resolve correctly while the provider is still not signing. DNS publication, provider activation, and a passing signature are three separate checks.

What MailFixIt can check

MailFixIt can evaluate the public DKIM configuration and show missing, conflicting, or invalid DNS evidence. It cannot log in to Google Workspace or prove private account state.

Use the related guides for the exact DNS or authentication result. Test again after the provider has accepted the configuration.

Frequently asked questions

What does MailFixIt check for Google Workspace?

It checks the public DKIM record and visible conflicts. The provider console must confirm account activation, and a new message or delivery test must confirm the result.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Google Workspace DKIM setup.