On this page

Fixing DKIM in Cloudflare for Google Workspace

What this fixes

DKIM lets receiving servers verify your mail hasn't been altered in transit and really came from you. See Fixing DKIM Record Issues for what it does and why it matters. For Google Workspace, the DKIM record is a TXT record — the key itself has to be generated in the Google Admin console first, then published to DNS.

Step 1: Generate the key in Google Workspace

  1. Go to Menu → Apps → Google Workspace → Gmail in the Admin console.
  2. Click Authenticate email, and select your domain.
  3. Click Generate New Record.
  4. Choose 2048-bit key length (recommended; fall back to 1024-bit only if your DNS provider can't handle a 2048-bit record's length).
  5. Click Generate. Google shows you a TXT record name (a selector, default prefix google, giving a host of google._domainkey) and a value (the public key).

Step 2: Publish it in Cloudflare

  1. Log in to the Cloudflare dashboard and select your domain.
  2. Go to DNS → Records → Add record.
  3. Set Type to TXT.
  4. Name: google._domainkey (or whatever selector Google generated for you).
  5. Content: paste the full value Google gave you.
  6. Set TTL to Auto.
  7. Click Save.

Step 3: Turn on DKIM signing

  1. Back in the Google Admin console, wait a few minutes for DNS to propagate.
  2. Return to Authenticate email for the domain and click Start Authentication.
  3. Re-run your scan to confirm.

Common pitfalls

  • Publishing the DNS record but forgetting to click Start Authentication in Google — the key exists in DNS but Google won't actually sign mail with it until you flip this on.
  • Truncated TXT values — Google's 2048-bit key is long; make sure Cloudflare's record editor hasn't cut it off (paste the whole string Google gives you, including any quotation marks Google includes in the copy box).