mediumSeverity: mediumRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.Google Admin + DNS · TXTWhere it livesImplementationThis fix is applied in: Google Admin + DNS · TXT. That's the surface you'll edit, DNS, response headers, or a static file.~10 minTime to fixEffortRoughly 10 minutes of hands-on work, propagation aside. Most of these are copy-paste.

DKIM: cryptographically sign every email you send

DKIM is the signature that survives forwarding, turn it on

The threat

SPF authorizes servers, but it breaks the moment a message is forwarded, the forwarder becomes the sender and SPFSPFEmail authSender Policy Framework: a DNS record listing which mail servers are allowed to send email as your domain, so spoofed senders get flagged. fails. DKIMDKIMEmail authDomainKeys Identified Mail: a cryptographic signature added to your outgoing email and verified against a public key in your DNS. Unlike SPF, it survives forwarding. fixes that: it attaches a cryptographic signature to every message, tied to a public key in your DNSDNSInfrastructureThe Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain.. The signature travels with the email, so receivers can verify it came from you and wasn’t altered, even after forwarding.

Without DKIM, your DMARC policy passes on SPF alone, which is fragile. DKIM is what makes enforcement safe.

The exact fix

DKIM is generated in your mail provider first, then published to DNS.

  1. Go to admin.google.com → Apps → Google Workspace → Gmail → Authenticate email.
  2. Select your domain, Generate new record, choose 2048-bit.
  3. Google gives you a host (selector) and a long value. Publish it as DNS:
FieldValue
TypeTXT
Namegoogle._domainkey
Valuev=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0B… (the full key Google generated)
TTL3600
  1. Return to the Google Admin page and click Start authentication.

Paste the key complete. 2048-bit keys are long. The #1 failure is a truncated or space-mangled p= value. Copy the entire string with nothing cut off. Adding the DNS record does nothing until you click Start authentication.

Verify it

dig +short TXT google._domainkey.yourdomain.com

You should see the v=DKIM1; k=rsa; p=… value returned in full. If it comes back empty or cut off, re-paste, that’s truncation.

Proof

With DKIM signing live alongside SPF and DMARCDMARCEmail authDomain-based Message Authentication: a DNS policy telling receivers what to do with mail that fails SPF or DKIM, and which emails you a report of everyone spoofing you., dev3lop.com reached full email authentication, the foundation that let us safely move DMARC from monitor to enforcement on the way to a perfect 100 / grade A, #1 of 353.