DKIM selector not found in Google Workspace: how to fix it

How DKIM selectors work

DKIM signs each outgoing message with a private key. The matching public key is published in DNS as a TXT record at selector._domainkey.yourdomain.com. The selector is just a label, so a domain can have several keys at once, for example one for Google Workspace and one for a sending tool. The message's DKIM-Signature header says which selector and domain were used.

A checker that looks up the wrong selector will report 'not found' even if you have DKIM working under a different one. Google Workspace's default selector is google, so the record is normally at google._domainkey.yourdomain.com.

Why Google Workspace shows no DKIM record

• The key was never generated. Google does not publish a DKIM record for you, since your domain's DNS is yours.
• The record was published at the wrong host name, for example with the domain name doubled.
• You chose a custom selector prefix when generating the key, but the checker is looking at google.
• The record was added but DNS has not updated yet.
• The record is published, but you did not click the Start authentication button in the admin console, so Google is not signing yet.

Fix it step by step

1. Sign in to the Google Admin console as an administrator.
2. Go to Apps, then Google Workspace, then Gmail, then Authenticate email.
3. Select the domain you want to sign for.
4. Generate a new record. Choose a 2048-bit key if your DNS provider supports it, and keep the default selector prefix of google unless you have a reason to change it.
5. Copy the host name and the TXT value that Google shows.
6. In your DNS provider, create a TXT record with that host name and value.
7. Wait for DNS to update, then return to the admin console and click Start authentication.

Google's own help pages describe the current console layout, which may change, so follow them if the menu names differ.

Typical DNS entry mistakes

• Many DNS providers add the domain automatically, so the host should be google._domainkey, not google._domainkey.yourdomain.com. If you see your domain twice in the lookup, this is why.
• A 2048-bit key is longer than 255 characters, and the TXT string limit is 255 characters per string. Some providers split it for you, others require you to split it into several quoted strings in one record. Follow your provider's instructions.
• Stray spaces or line breaks pasted into the value, which break the key.
• Smart quotes copied from a document.
• Publishing it as a CNAME instead of a TXT record.

How to verify

Wait for DNS to update, which depends on the TTL and your provider. Then run your domain through the free checker, and make sure it is checking the right selector. For the real test, send a message from a Workspace mailbox to a Gmail address you own, open Show original, and look for dkim=pass with header.d=yourdomain.com. If it says header.d= for another domain, the message is signed by someone else and will not align for DMARC.

Other sending tools need their own DKIM

If you send cold email through a sequencing platform, that tool often signs with its own domain by default. To align with your From domain, set up custom DKIM in that tool as well, with its own selector and record. That gives you two valid selectors on the same domain. See the DMARC guide for why alignment matters.

Rotating the key

Security guidance generally suggests rotating DKIM keys periodically. When you rotate, publish the new selector first, switch signing to it, then remove the old record later, so that messages already in transit can still be verified.