On this page

Fixing DKIM in AWS Route 53 for Google Workspace

What this fixes

DKIM lets receiving servers verify your mail hasn't been altered in transit and really came from you. See Fixing DKIM Record Issues for what it does and why it matters. For Google Workspace, the DKIM record is a TXT record — the key itself has to be generated in the Google Admin console first, then published to DNS.

This assumes you already have a hosted zone in Route 53 for your domain, and IAM permissions to edit it.

Step 1: Generate the key in Google Workspace

  1. Go to Menu → Apps → Google Workspace → Gmail in the Admin console.
  2. Click Authenticate email, and select your domain.
  3. Click Generate New Record.
  4. Choose 2048-bit key length (recommended).
  5. Click Generate. Google shows you a TXT record name (default selector google, giving a host of google._domainkey) and a value (the public key).

Step 2: Publish it in Route 53

  1. Open the Route 53 console and go to Hosted zones → select your domain's hosted zone.
  2. Click Create record.
  3. Record name: google._domainkey
  4. Set Record type to TXT.
  5. Under Value, paste Google's key wrapped in double quotes — Route 53 requires this for TXT records. If the key is long enough that Google's copy box already splits it into multiple quoted segments, keep those segments as Google provided them.
  6. Leave TTL at the default.
  7. Click Create records.

Step 3: Turn on DKIM signing

  1. Back in the Google Admin console, wait a few minutes for DNS to propagate.
  2. Return to Authenticate email for the domain and click Start Authentication.
  3. Re-run your scan to confirm.

Common pitfalls

  • Forgetting to wrap the TXT value in double quotes.
  • Publishing the DNS record but forgetting to click Start Authentication in Google.