DKIM is a digital cryptographic signature that is added to outgoing message headers in order to prevent spoofing.
This is done by generating a private domain Key to encrypt outgoing mail headers and by adding a public key into your DNS.
How to generate the Domain key:
- Sign in to your Google Admin console.
- From the Admin console Home page, go to Apps>> G Suite >> Gmail.
- Click Authenticate email.
- Your primary domain is selected by default. Click your primary domain name and select another domain where you’ll use DKIM.
- Click Generate new record and you’ll see these options:
- Select DKIM key bit length—If your domain host supports 2048-bit keys, we recommend using them as they’re more secure. If you previously used a 1024-bit key, there’s no impact when you switch to a 2048-bit key.
If your domain host doesn’t support 2048-bit keys, change the key length to 1024.
- Select DKIM key bit length—If your domain host supports 2048-bit keys, we recommend using them as they’re more secure. If you previously used a 1024-bit key, there’s no impact when you switch to a 2048-bit key.
- Prefix selector—Domain keys include a text string called the prefix selector which you can modify when you generate the key. The default prefix selector for the Gmail domain key is google. Change the prefix only if your domain already uses a DKIM key with the prefix selector google.
- Click Generate.
Use the text at TXT record value to update the DNS record at your domain host. Remote mail servers retrieve this public key from the DNS record and use it to validate messages from your domain.
Important: If you recently set up G Suite or Gmail, you might see this error: “We are unable to process your request at this time. Please try again later. (Error #1000).”
After you turn on Gmail, you must wait 24–72 hours before you can generate a DKIM key.