You send a test to a friend, open Show original in Gmail and see "DKIM: FAIL." DKIM is a signature on your outgoing mail that proves it was not changed on the way and that your domain approved it. A fail makes it more likely to land in spam, and Google asks for it from everyone who sends. The fix is usually one of five things.

How to read the result

In Gmail, open a message you received, click the three dots and choose Show original. At the top you will see lines for SPF, DKIM and DMARC. A good line says PASS with your domain. If you see FAIL, the line shows the domain that was checked. If there is no DKIM line at all, no signature was added. That points to setup rather than a broken record.

Cause 1: you never turned it on

In Google Workspace, creating the DNS record is only half of it. Google's setup steps tell you not to click Start authentication until the record exists at your domain host, and then you must come back and click it. Go to the Admin console, Apps, Google Workspace, Gmail, Authenticate email, pick your domain and check that the status says "Authenticating email with DKIM."

Cause 2: the record was added wrong

The TXT record host should be your selector followed by ._domainkey, for example google._domainkey. The value starts with "v=DKIM1; k=rsa; p=". Common mistakes:

  • The host name has the domain doubled (google._domainkey.example.com.example.com) because your DNS provider adds the domain automatically. Enter only the part before your domain.
  • The value was pasted with extra quotes, spaces or line breaks.
  • The record is on the wrong domain or subdomain. Each domain needs its own record and key.
  • Your host rejects long values. Some hosts limit TXT length, so check their documentation, or use the shorter 1024 bit key if they do not support 2048.

Cause 3: you did not wait

Google says DNS changes can take up to 48 hours to work, and that after you turn on Gmail you should wait 24 to 72 hours before generating the key. The Admin console may show an "update the DNS records" message for up to 48 hours even when the setup is correct. Check again the next day before changing anything.

Cause 4: you tested the wrong way

Google's guidance is that you cannot verify DKIM by emailing yourself. Send a test to a different Gmail or Workspace address and check the headers there. Look for Authentication-Results and "dkim=pass."

Cause 5: something changed the message

A DKIM signature breaks if a service alters the body after signing. Mailing lists that add footers, forwarding tools and some security gateways do this. If the fail only happens for certain recipients, look at what sits between you and them. Also, if a third party sends mail for your domain, such as a newsletter service, it needs its own DKIM setup for your domain.

If you use more than one service to send

Many domains send from more than one place: the mailbox itself, a newsletter tool, an invoicing system and a support desk. Each of them can sign with its own DKIM key, and each needs its own record at your domain host. If your own mail passes and one tool fails, the problem is that tool's setup, not your main record. Check each sender separately by sending a real message from it to a Gmail address and reading the headers. Keep a short list of every service that sends as your domain and when its keys were last checked.

Check it again

  1. Wait the full 48 hours after any DNS change.
  2. Send a fresh test to another Gmail address.
  3. Open Show original and confirm DKIM, SPF and DMARC all say PASS.

For the bigger picture, see SPF, DKIM and DMARC for cold email and Gmail's sender requirements. If DMARC is the failing line, read DMARC fail.

Rocketship sends from your own Gmail, so your domain's authentication and your reputation stay yours. Try it for 7 days, card required to begin.