Why is no DKIM key found for my Google Workspace domain?

Most often because DKIM was never turned on for the domain and the key never published in DNS. A custom selector is the other possibility.

Does using Google Workspace mean SPF is already set up?

No. The SPF record is published in your DNS, not by Google. It must authorise Google and every other service that sends as the domain.

Can the audit tell whether my mail reaches inboxes?

No. It reads the records that decide authentication; inbox placement depends on each receiver.

Platforms

Google Workspace (mail)

A domain whose mail is handled by Google Workspace is recognised from its MX records, which point at Google's mail servers. That recognition decides what is checked next: the sender policy must authorise Google, a DKIM key must be published — Google's help centre treats DKIM as something the administrator has to turn on — and a DMARC record tells receivers what to do with mail that fails. For the key, the engine probes the `google` selector by name, the one Google Workspace uses by default.

How the engine recognises it

An MX record whose host matches Google's mail domains, read from public DNS.

An SPF record including Google's sender policy is also treated as evidence when no MX points at Google.

The provider is reported as a mail provider in the technology inventory, alongside DNS and hosting providers.

Recognition is exact: MX records are published facts, not inferences.

DKIM: the google selector

DKIM public keys are published at a name made of a selector and `_domainkey`, and a receiver learns the selector from each message's signature.

An external check has no message to read, so it can only query selectors it knows. For a domain on Google Workspace, it queries `google._domainkey`, the default selector recorded in the engine's provider table.

Google's help centre presents DKIM as a setting to turn on, which is why a Google Workspace domain can run for years without a key.

A Google Workspace domain with no key at that selector has usually never turned DKIM on — or uses a custom selector, which is why the result is reported as not found rather than as absent.

SPF and DMARC

Google's help centre explains defining an SPF record that authorises Google's servers to send for the domain.

Every other service that sends as the domain needs authorising in the same single record, and the lookup limit applies to the total.

Google's help centre covers adding the DMARC record, which is published in the domain's own DNS like the other two.

Alignment is what ties them together: mail passes DMARC when SPF or DKIM passes for the domain in the From header.

What an external audit can and cannot tell

It can read the MX, SPF, DKIM and DMARC records exactly as published.

It cannot tell which users exist, how mail is routed internally, or whether a custom DKIM selector is used.

It cannot see whether mail actually lands in inboxes; that depends on each receiver.

It never sends mail.

Which checks apply

`email.mx.present` and `email.mx_targets` report the MX records and where they point.

`email.spf.present`, `email.spf.lookups` and `email.spf.all` report the sender policy.

`email.dkim.selectors` reports the provider selectors probed and whether a key was found.

`email.dmarc.present`, `email.dmarc.policy` and `email.dmarc.alignment` report the DMARC record.

What the DKIM key itself shows

When a key is found at the selector, the engine records its type and a size class, and never stores the key itself.

RFC 8301 requires signers to use RSA keys of at least 1024 bits and recommends at least 2048, which is the benchmark the size class is read against.

The same RFC says verifiers must not consider signatures made with RSA keys shorter than 1024 bits as valid.

The selector name is only a label; what matters for authentication is that the key it points to is published, valid and strong enough.

RFC 8301 also requires verifiers to handle keys from 1024 up to 4096 bits, so a 2048-bit key is safe to publish for every receiver.

Frequently asked questions

Why is no DKIM key found for my Google Workspace domain?: Most often because DKIM was never turned on for the domain and the key never published in DNS. A custom selector is the other possibility.
Does using Google Workspace mean SPF is already set up?: No. The SPF record is published in your DNS, not by Google. It must authorise Google and every other service that sends as the domain.
Can the audit tell whether my mail reaches inboxes?: No. It reads the records that decide authentication; inbox placement depends on each receiver.

Sources

VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.

Scan a website