Ask Quokka
Sign inGet started free

Free tools · Email domain setup

Google Workspace DKIM Setup and Selector Check

Google Workspace DKIM setup has two parts: publishing the domain's public key in DNS and enabling signing in the Admin console. This checker inspects DNS; an administrator controls the Google settings.

Real public DNS lookup. No signup, mailbox connection or API key needed.

Check DKIM recordRead the steps

Check your published DKIM record

Enter your own public domain and actual selector. The illustrated examples below are not preloaded and no lookup runs until you submit.

Use the domain only, without https:// or an email address.

Find the s= value in a sent message’s DKIM-Signature header, or ask your email provider. Enter only the selector.

The public domain and selector you enter are sent to AskQuokka to look up public DNS records. No mailbox connection is needed.

Look up your public DKIM record.

Enter your domain and its DKIM selector to see the published record and any issues found. Results appear here after a real DNS lookup.

What to do next

  1. 1. Choose the correct Workspace domain

    In the Google Admin console, open Gmail's Authenticate email settings and select the domain. Use an account with the required Gmail settings administrator privilege.

  2. 2. Generate the domain's key in Google

    Follow Google's current instructions to create the key. Copy the displayed DNS hostname and full public TXT value. Keep the selector shown for that domain rather than assuming a default.

  3. 3. Publish the supplied TXT value

    Use the DNS host's instructions for the hostname and full value. Check the same signing domain and selector below after the record is visible. AskQuokka does not generate a signing private key.

  4. 4. Enable signing and inspect a received test

    Return to Google's settings to start authentication after publishing the key. Follow Google's verification steps with a recipient's received message and inspect its DKIM result and signing domain.

Where the Google-provided values belong

Google-provided name: [your selector]._domainkey
Google-provided value: [the complete public TXT value]

Checker domain: your signing domain
Checker selector: the selector from Google's name

The bracketed fields are instructions, not DNS data. Copy the actual domain-specific values from Google. Do not paste a public example's key into your domain.

DNS visibility does not enable signing

A published key can exist before Google starts signing with it. Verify the Admin console's authentication state and a representative received message as separate checks.

A revoked old selector is a useful finding

The checker reports an empty p= as revoked. That does not establish the status of every other selector used by the domain or another sending service.

Questions

Do I connect Gmail to use this page?

No. This page sends only the entered public domain and selector to AskQuokka for DNS lookup. It does not request Google permissions.

Can AskQuokka turn DKIM on for me?

No. Your Workspace administrator creates and enables signing through Google, and your DNS administrator publishes the supplied public key.

Checking sends your public domain and selector to AskQuokka. Record generation and copying run in this tab. No DNS settings are changed and no email is sent. Domain inputs and lookup results are not included in tool analytics.

Official references

References checked 23 October 2026. Use your provider's current domain-specific values.

More setup and troubleshooting guides

How to Find Your DKIM Selector

Find the s= selector and d= signing domain in a DKIM-Signature header, then look up that exact public key with the free checker.

Microsoft 365 DKIM: CNAME and Selector Guide

Understand Microsoft's two DKIM selectors, copy the tenant-specific CNAME targets and check the selected signing key. Free domain and selector lookup.