How to Generate 2048-bit DKIM Key in Admin Console

DKIM (DomainKeys Identified Mail) prevents email spoofing by attaching an asymmetric cryptographic signature to outbound messages. Google Workspace supports both 1024-bit and 2048-bit key lengths. While 1024-bit keys were historically standard, modern email deliverability standards require 2048-bit encryption keys. A 2048-bit key provides stronger cryptographic security and complies with inbound authentication mandates enforced by major mailbox providers.

Quick Answer

To generate a 2048-bit DKIM key, log in to the Google Admin Console, go to Apps > Google Workspace > Gmail > Authenticate email, select your domain, and click Generate new record. Choose 2048 as the key length, click Generate, copy the resulting TXT record to your DNS host, and then click Start authentication.

---

Why You Should Use 2048-bit Keys Instead of 1024-bit

• Cryptographic Longevity: 1024-bit RSA keys can theoretically be factored with modern distributed computing power. Major security frameworks consider 2048-bit the minimum safe key size.
• Inbound Deliverability Requirements: Providers like Gmail, Yahoo, and Microsoft use strict anti-spam algorithms. Domains utilizing 2048-bit DKIM keys establish higher initial sender reputation scores.
• The Single-String DNS Limitation: The only reason 1024-bit keys remain available is that some legacy DNS registrars do not support TXT records longer than 255 characters. 2048-bit keys generate public key strings around 400 characters, requiring modern DNS management.

---

Prerequisites Before Generating

Before creating the key in Google Workspace:

1. Ensure you have Super Admin privileges in Google Workspace.
2. Ensure you have administrative access to your domain’s DNS control panel (e.g., Cloudflare, GoDaddy, Namecheap, AWS Route 53).
3. Ensure your domain’s MX records are already pointed to Google Workspace.

---

Step-by-Step Configuration Guide

Step 1: Generate the Key in Google Admin Console

1. Sign in to the Google Admin Console.
2. From the Home page, navigate to Apps > Google Workspace > Gmail.
3. Click on Authenticate email.
4. Under Selected domain, use the drop-down menu to choose the domain you want to authenticate.
5. Click Generate new record.
6. In the modal dialog:
   • Select DKIM key bit length: Choose 2048 (recommended).
   • Prefix selector: Keep the default value google (unless you are rotating keys and need a distinct selector like google2).
7. Click Generate.
8. The Admin Console will present two strings:
   • DNS host name (TXT record name): Typically google._domainkey
   • TXT record value: A string beginning with v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAA...

Keep this browser tab open. Do not click “Start Authentication” yet.

+------------------------------------------------------------------------------------+
| GOOGLE WORKSPACE ADMIN CONSOLE                                                     |
| 1. Generate 2048-bit TXT Value (google._domainkey)                                 |
+------------------------------------------------------------------------------------+
                                         │
                                         ▼ (Copy & Paste)
+------------------------------------------------------------------------------------+
| DNS HOST (Cloudflare / GoDaddy / Route 53)                                         |
| 2. Add TXT Record -> Name: google._domainkey | Value: v=DKIM1; k=rsa; p=MIIB...    |
+------------------------------------------------------------------------------------+
                                         │
                                         ▼ (Wait for DNS propagation)
+------------------------------------------------------------------------------------+
| GOOGLE WORKSPACE ADMIN CONSOLE                                                     |
| 3. Click "Start Authentication" -> Status flips to "Authenticating email"          |
+------------------------------------------------------------------------------------+

---

Step 2: Publish the TXT Record in Your DNS Manager

Open a new browser tab, log in to your DNS provider, and add the public key:

1. Navigate to your domain’s DNS Records management screen.
2. Click Add Record.
3. Select TXT as the record type.
4. In the Name / Host field, enter:(Note: Some DNS providers, like GoDaddy and Namecheap, automatically append your root domain. If your provider does this, enter only google._domainkey. If your provider requires the fully qualified domain name, enter google._domainkey.yourdomain.com). google._domainkey

google._domainkey

1. In the Value / Content field, paste the long public key string provided by Google.
2. Set TTL to 300 (or Automatic).
3. Save the record.

---

Handling the DNS 255-Character Limit Issue

A standard 2048-bit public key string is approximately 400 characters long. The DNS specification (RFC 4408 / RFC 1035) limits individual text strings inside a TXT record to 255 bytes.

How your DNS host handles this depends on their software:

• Modern Providers (Cloudflare, AWS Route 53, Google Cloud DNS): These systems automatically handle string splitting behind the scenes. You can paste the entire continuous string into the value box, and the system splits it into valid chunks transparently.
• Legacy or BIND-based DNS Panels: If your host rejects the value with an error like “String exceeds maximum length of 255 characters”, you must break the value into two double-quoted strings separated by a space within the same record:
  DNS resolvers reassemble contiguous quoted strings into a single value upon lookup. "v=DKIM1; k=rsa; p=FIRST_HALF_OF_KEY_STRING..." "SECOND_HALF_OF_KEY_STRING..."

"v=DKIM1; k=rsa; p=FIRST_HALF_OF_KEY_STRING..." "SECOND_HALF_OF_KEY_STRING..."

---

Step 3: Activate Authentication in Google Workspace

Once the DNS record is saved, return to the Google Admin Console tab.

1. Do not rush to click the button immediately. Allow several minutes for your DNS provider to publish the record to public resolvers.
2. Click Start authentication.
3. If Google successfully detects and cryptographically validates the public key in your DNS, the status text at the top of the page will change from Not authenticating email to a green status: Authenticating email.

---

Troubleshooting Activation Failures

If clicking “Start authentication” returns an error stating “Email authentication was not started. Please verify your DNS settings”:

• Verify Propagation: Open an external lookup tool (like Google Admin Toolbox “Check MX” or Dig) and query the TXT record for google._domainkey.yourdomain.com. If the record returns empty, your DNS host has not propagated the change. Review How to Fix DNS Propagation Lag for New Domains.
• Look for Key Truncation: Ensure the public key was not truncated during copy-pasting. If the closing characters are missing, the RSA signature validator fails. See DKIM “Public Key Not Found” Error.
• Check Key Rotation Policies: If your organization requires changing keys periodically, do not overwrite an active key while traffic is in flight. Follow proper overlapping procedures via How to Rotate DKIM Keys Without Breaking Delivery.
• Complete Your Security Stack: DKIM is only one leg of modern authentication. To verify that your SPF and DMARC records align correctly alongside your new 2048-bit signature, follow The Workspace Email Authentication Master Checklist.