Google Workspace DKIM for Secondary Domains

Why each secondary domain needs its own key

Google's help page is direct about it: you must get a unique DKIM key from the Admin console for each domain. Until you do, Gmail still signs outgoing mail, but with a Google domain, not yours. That signature does not align with your From domain, so it does not help DMARC, and Gmail and Yahoo treat the mail as less trusted. Bulk mail without aligned SPF or DKIM is blocked with errors such as 550 5.7.26.

Step by step

1. In the Google Admin console, open Apps → Google Workspace → Gmail → Authenticate email.
2. In Selected domain, pick the secondary domain. The menu lists each domain separately.
3. Click Generate new record. Choose 2048 bits (Google recommends it when your DNS host supports it). Keep the prefix google unless you already use it for another key.
4. Copy the TXT record and add it in your DNS host:

Type:   TXT
Host:   google._domainkey        (on the secondary domain)
Value:  v=DKIM1; k=rsa; p=MIIBIjANBgkq...   (copy exactly from the Admin console)

5. When the record is live, go back to Authenticate email, select the same domain and click Start authentication.
6. Repeat for every sending domain.

Why is Generate new record missing or failing?

• The domain is new to Gmail. Google says you must wait 24–72 hours after you set up Gmail before you can get the DKIM key.
• Your DNS host limits TXT length. Some hosts cannot store a 2048-bit key in one value. Split the value into several quoted strings if your host supports it, or generate a 1024-bit key.
• DKIM does not pass yet. Google says it can take up to 48 hours for DKIM authentication to start working after you start it.

The other records each domain needs

MX     @         smtp.google.com   (priority 1)
TXT    @         v=spf1 include:_spf.google.com ~all
TXT    _dmarc    v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Gmail requires DMARC for bulk senders, and p=none meets the rule. If the domain also sends through other services, add them to the same SPF record — never publish a second one.

Check all your domains

Use the DKIM checker (selector google) for one domain, or the cold email domain health check for up to 5 at once. DKIM keys get removed during DNS moves more often than any other record; domain monitoring checks every domain daily and alerts you the day one disappears.