DKIM that's enabled in the admin console but never actually signing your mail is one of the most common silent authentication failures in cold email — everything looks configured, and every email quietly fails DKIM anyway. Getting DKIM right means two distinct steps most guides blur together: enabling it in your provider, and publishing the DNS records that make it actually sign. This step-by-step DKIM setup covers both Google Workspace and Microsoft 365, in order, with the verification step that confirms it's genuinely working — not just switched on. Follow it and your cold email inboxes pass DKIM for real, which is half of what mailbox providers check before trusting you.
What DKIM Actually Does (Quickly)
Before the steps, thirty seconds on why DKIM matters, because it shapes the setup. DKIM attaches a cryptographic signature to your outgoing email. The receiving server checks that signature against a public key you publish in DNS — if it matches, the email is verified as genuinely from your domain and unaltered.
For cold email, DKIM is one of the three authentication pillars alongside SPF and DMARC. Miss it and your mail fails authentication, which mailbox providers treat as a strong spam signal. In 2026, unauthenticated bulk mail to Gmail and Yahoo isn't just filtered — it's rejected.
💡 The two-part nature of DKIM
DKIM setup is always two steps: enable signing in your email provider, and publish the matching key in DNS. Both must be done — enabling without publishing means DKIM isn't signing, and publishing without enabling means there's nothing to verify. The most common failure is doing one and assuming you're done. Keep both steps in mind throughout.
Now the setup, provider by provider.
DKIM Setup for Google Workspace
Here's the step-by-step for Google Workspace. You'll work in the Google Admin console and your DNS provider.
Open the Admin console. Go to admin.google.com, then Apps → Google Workspace → Gmail → Authenticate email.
Select your domain and generate the DKIM key. Google gives you a DNS TXT record — a host/name value and a long key value.
Publish the TXT record in DNS. Add it at your DNS provider exactly as Google shows it. The host is typically google._domainkey.
Wait for propagation. DNS changes take time — anywhere from minutes to a few hours.
Return to the Admin console and click Start authentication. This is the step people miss — generating the key isn't enough; you must turn signing on.
🚩 The Google Workspace DKIM trap
Publishing the DNS record but forgetting to click Start authentication in the Admin console. The record is live, so a DNS check looks fine — but Google isn't actually signing your mail because you never turned signing on. Both the DNS record AND Start authentication are required. This exact miss is why so many Workspace inboxes fail DKIM despite looking set up.
DKIM Setup for Microsoft 365
Microsoft 365 works differently — it uses CNAME records rather than a single TXT key, and you enable DKIM in the Defender portal.
Publish two CNAME records. Microsoft 365 DKIM uses two CNAMEs (selector1 and selector2) pointing to Microsoft's signing infrastructure. Add both at your DNS provider.
Open the Defender portal. Go to the Microsoft Defender portal, then Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
Select your domain and enable DKIM signing. Toggle it on — this is the equivalent of Google's Start authentication step.
Confirm it's signing. The portal will show DKIM as enabled once the CNAMEs are detected and signing is on.
Step | Google Workspace | Microsoft 365 |
|---|---|---|
DNS record type | One TXT record | Two CNAME records |
Where to enable | Admin console | Defender portal |
The must-not-miss step | Click Start authentication | Toggle DKIM signing on |
For the wider Microsoft authentication picture, see our Microsoft 365 DKIM guide.
Verifying DKIM Actually Works
This is the step that separates "I set up DKIM" from "DKIM is working." Never skip it — enabling and publishing doesn't guarantee signing is live.
The fastest verification: send a test email from your inbox to a Gmail address you control. Open it, click the three dots, choose Show original, and read the Authentication-Results header. You want to see DKIM: PASS. If it says fail, none, or is missing, DKIM isn't signing correctly and you have a setup gap to fix.
Send a test to Gmail from the inbox you configured.
Open Show original and find the DKIM result.
DKIM: PASS means it's genuinely signing. Anything else means go back and check.
Cross-check with a DNS tool like MXToolbox to confirm the DKIM record is published and valid.
If DKIM fails verification, the usual culprits are: the DNS record not propagated yet (wait longer), the signing step not enabled (Start authentication / toggle), or a typo in the published record. Work through those three. For the full set of authentication checks, see our authentication checklist.
When DKIM Is Already Done for You
Here's the honest note after the step-by-step. DKIM setup isn't hard, but it's fiddly and easy to get subtly wrong — the enable-but-don't-publish gap, the publish-but-don't-enable gap, the typo in a long key. Across many inboxes, something usually slips.
That's the case for inboxes that arrive with DKIM already configured and verified. Pre-warmed inboxes ship with DKIM signing correctly — the DNS records published, signing enabled, and verified passing — so the two-part setup and its common traps are handled before you receive them. You still run the Show original check to confirm, but you're verifying a known-good configuration rather than debugging which of the two steps you missed.
Litemail pre-warmed Google Workspace and Microsoft 365 inboxes come with DKIM pre-configured alongside SPF and DMARC, all verified passing, on dedicated US and EU IPs from $4.99/inbox — so DKIM is one less thing to set up, and one less silent failure to hunt for. For teams running many inboxes, that removes a repetitive, error-prone step entirely. For the Microsoft SPF companion setup, see our Microsoft 365 SPF guide.
DKIM done and verified, before you send. Litemail pre-warmed Google Workspace and Microsoft 365 inboxes ship with DKIM signing correctly configured alongside SPF and DMARC, all verified passing, on dedicated US and EU IPs — no two-step setup traps, from $4.99/inbox. Verified Good or High in Postmaster within 48 hours, full admin access included. Get Pre-Warmed Inboxes from $4.99 →
About Litemail — Litemail provides pre-warmed Google Workspace and Microsoft 365 inboxes for cold email outreach. From $4.99/inbox with automated DNS, dedicated US and EU IPs, and full admin access. View pre-warmed inbox plans →
Related reading: Microsoft 365 DKIM Guide · Authentication Checklist · Check SPF, DKIM & DMARC · Microsoft 365 SPF Fix · DNS Setup Checklist · Litemail Pre-Warmed Inboxes — Plans and Pricing
The Bottom Line
DKIM setup is always two steps: enable signing in your provider AND publish the matching DNS record — both are required.
Google Workspace uses one TXT record plus clicking Start authentication in the Admin console.
Microsoft 365 uses two CNAME records plus toggling DKIM signing on in the Defender portal.
The most common failure is publishing the record but never enabling signing — it looks set up but doesn't sign.
Always verify with a Gmail Show original check for DKIM: PASS — enabling isn't proof it's working.
Pre-warmed inboxes ship with DKIM configured and verified, removing the two-step traps across many inboxes.
Frequently Asked Questions
How do I set up DKIM for a cold email inbox?
It's two steps: enable DKIM signing in your email provider and publish the matching DNS record. In Google Workspace, generate the key in the Admin console, publish the TXT record, then click Start authentication. In Microsoft 365, publish two CNAME records, then enable DKIM signing in the Defender portal. Then verify with a Gmail Show original check for DKIM: PASS.
Why is my DKIM not working even though I set it up?
The most common reason is publishing the DNS record but never enabling signing — clicking Start authentication in Google Workspace or toggling DKIM on in Microsoft's Defender portal. The record looks live on a DNS check, but your provider isn't actually signing mail. Other causes are the record not having propagated yet or a typo in the published key. Verify with a Show original check.
What's the difference between Google and Microsoft DKIM setup?
Google Workspace uses a single TXT record and you enable signing by clicking Start authentication in the Admin console. Microsoft 365 uses two CNAME records (selector1 and selector2) pointing to Microsoft's infrastructure, and you enable signing by toggling DKIM on in the Defender portal. Both require publishing the DNS records and separately turning signing on — the record alone isn't enough.
How do I verify DKIM is actually signing my email?
Send a test email from your inbox to a Gmail address you control, open it, click the three dots, choose Show original, and read the Authentication-Results header for DKIM: PASS. If it says fail, none, or is missing, DKIM isn't signing correctly. Cross-check with a DNS tool like MXToolbox to confirm the record is published and valid.
Is DKIM required for cold email in 2026?
Effectively yes. DKIM is one of the three authentication pillars with SPF and DMARC, and in 2026 unauthenticated bulk mail to Gmail and Yahoo is rejected rather than just filtered. Missing DKIM causes authentication failure that mailbox providers treat as a strong spam signal. Any serious cold email setup needs DKIM signing correctly and verified passing.
Does Litemail configure DKIM for me?
Yes. Litemail pre-warmed Google Workspace and Microsoft 365 inboxes ship with DKIM signing correctly configured — records published and signing enabled — alongside SPF and DMARC, all verified passing, on dedicated US and EU IPs from $4.99/inbox. You can still run the Show original check to confirm, but you're verifying a known-good setup rather than debugging the two-step DKIM traps.
Buy Pre-Warmed Email Inboxes & Domains | Litemail
Buy pre-warmed email accounts, inboxes and domains from $4.99/inbox. Google Workspace & Microsoft 365. DKIM, SPF & DMARC pre-configured, US & EU IPs, setup in 5 minutes.
No minimum order · DKIM done and verified · US and EU IPs
Related reading: Microsoft 365 DKIM Guide · Authentication Checklist · Check SPF, DKIM & DMARC · DNS Setup Checklist · Litemail Pre-Warmed Inboxes — Plans and Pricing
