Email records · Amazon Route 53 · Google Workspace

How do I set up DKIM at Amazon Route 53 for Google Workspace?

Generate the DKIM key in the Google Admin console, add it in your Amazon Route 53 DNS records as a TXT record named google._domainkey, then select Start authentication in the Admin console.

Last read , from the sources at the foot of this page.

Check my firm Read the steps
01

What does DKIM do?

It adds a signature to each message your domain sends. A mail server checks the signature against a key published in your DNS, so a message changed or forged on the way fails.

02

Where does Google Workspace make the key?

In the Google Admin console, go to Apps, then Google Workspace, then Gmail, and open Authenticate email. Select your domain and generate a new record. Choose a 2048-bit key if your DNS host takes one, and 1024-bit if it does not. Keep the selector google. Do not select Start authentication yet.

Name of the record
google._domainkey
Its value begins
v=DKIM1;
03

How do I add it at Amazon Route 53?

  1. Sign in to the AWS console and open Route 53.
  2. Choose Hosted zones, then choose the zone named for your domain.
  3. Choose Create record, keep Simple routing, and set Record type to TXT.
  4. Type google._domainkey in Record name. Leave your domain name out: it is added for you.
  5. Paste the whole value Google shows in Value, inside double quotation marks.
  6. Choose Create records.

Route 53 takes at most 255 characters in one quoted string. Split a longer key into strings of 255 characters or fewer, each in its own quotation marks, on one line.

In our words, from Amazon Route 53: adding a TXT record, read 14 October 2026. If a screen has changed since, follow the host's own page.

04

How do I turn signing on?

Go back to Authenticate email in the Admin console and select Start authentication. The status changes to say that email is being authenticated with DKIM. If it does not, wait for your DNS change to be seen and try again.

Sources

Where does this come from?

DMARC at Amazon Route 53 for Google WorkspaceSPF at Amazon Route 53 for Google WorkspaceDKIM at Amazon Route 53 for Microsoft 365Every DNS host and record
06 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy