Cis Gworkspace 3.1.3.2.1

3.1.3.2.1 Ensure that DKIM is enabled for all mail enabled domains

Overview

Description

DKIM adds an encrypted signature to the header of all outgoing messages. Email servers that get signed messages use DKIM to decrypt the message header, and verify the message was not changed after it was sent.

Rationale

Spoofing is a common unauthorized use of email, so some email servers require DKIM to prevent email spoofing.

Impact

There should be no impact of setting up DKIM however, organizations should ensure appropriate setup to ensure continuous mail-flow.

Default Value

None

Audit

To verify this setting via the Google Workspace Admin Console:

1. Log in to https://admin.google.com as an administrator
2. Select Apps
3. Select Google Workspace
4. Select Gmail
5. Under Authenticate email, ensure a DKIM record exists for each mail enabled domain

Remediation

To configure this setting via the Google Workspace Admin Console:

1. Log in to https://admin.google.com as an administrator
2. Select Apps
3. Select Google Workspace
4. Select Gmail
5. Under Authenticate email, select Generate new record
6. Under Select DKIM key bit length, select the appropriate key bit length (2048 is recommended if supported)
7. Under Prefix selector (optional), enter the appropriate prefix selector
8. Use the text at TXT record value to update the DNS record at your domain host
9. Select Start Authentication

CIS Controls