Turning On Email Authentication for Your Domain
What We Need From Your Google Workspace, and Why
Email providers like Gmail, Outlook and Yahoo no longer take a sender's word for it. Before they deliver a message, they check whether it really came from the business it claims to be from. Messages that cannot prove it get filtered to spam, or refused outright.
One of the checks is called DKIM. It works like a wax seal on a letter: Google signs every message your business sends, and the receiving provider checks the seal against a record published in your domain name settings. If the seal and the record match, the message is trusted.
The catch is that Google will not create that seal until someone switches it on, and the matching record has to be added to your domain separately. Plenty of Google Workspace accounts have never had either step completed — the mail still sends, so nobody notices.
Why This Matters Now
In 2024 Google and Yahoo began requiring authentication from anyone sending to their users, and enforcement has tightened since. Without DKIM in place:
• Your email is easier to impersonate. Someone can send a convincing invoice or request that appears to come from your address.
• Forwarded mail breaks. When a recipient forwards your message, or their address redirects to another inbox, the other security check (SPF) stops working. DKIM is what keeps the message trusted. Without it, forwarded mail is the first thing to disappear.
• You will not know it is happening. Nothing bounces back to you. The message simply never arrives.
What We Need From You
We need one piece of text from your Google Workspace admin console. It is a long string of letters and numbers — your domain's public key. It is not a password, it is safe to email, and it is designed to be published openly.
Only someone with administrator access to your Google Workspace can retrieve it, which is why we are asking you rather than doing it ourselves.
How To Find It
1. Sign in at admin.google.com with an account that has administrator access.
2. In the left menu, go to Apps → Google Workspace → Gmail.
3. Click Authenticate email.
4. If you have more than one domain, choose the right one from the Selected domain list at the top.
5. You will see a box labeled TXT record value, starting with v=DKIM1; k=rsa; p= followed by a long string. Copy the whole thing and send it to us.
Copying it as plain text is best. A screenshot works too, as long as the entire value is visible and readable — a single wrong character stops it from working.
Please Do Not Click “Generate New Record”
There is a button on that screen labeled Generate new record. It sits right next to the value you are copying, and it is the one thing on the page that can cause a problem.
Clicking it creates a brand new key and immediately starts using it. Any record already published becomes wrong, and mail that was being signed correctly stops verifying. If a value is already shown on the screen, just copy it. There is no need to generate anything.
What Happens Next
Once you send us the value, we add it to your domain's DNS settings, confirm it is live and correct, and let you know.
At that point you may need to return to the same screen and click Start authentication. We will tell you whether that step is needed — on some accounts it is already switched on, and the button will say Stop authentication instead. If it does, leave it alone: that means signing is already running and nothing further is required.
From then on it looks after itself. There is nothing to renew and nothing that expires.
A Note On Timing
Google warns that changes can take up to 48 hours to take effect. In practice it is usually minutes. We monitor the authentication reports for the domains we manage, so we will see it start working and can confirm it for you.
If anything on this page is unclear, call us at (719) 881-0098 or email info@sagentic.com and we will walk you through it, or join a screen share and do it together.
