Connecting a Google Workspace mailbox for warm-up

Connecting a Google Workspace mailbox over OAuth means authorising an app to send and read mail as that mailbox, without handing over a password. There is no app password, no SMTP host to type, and no IMAP toggle to find. What there is: a handful of admin settings that can block the flow, and some domain-side work that should be finished first.

Do the domain work before you connect

Warm-up builds reputation for an identity. If DKIM is not signing with your own key, you spend the ramp building reputation for the wrong one.

1. Generate the DKIM key. New Workspace domains do not sign with their own key until an admin does this. In the Admin console: Apps → Google Workspace → Gmail → Authenticate email, generate a key, publish the TXT record at the given selector, then start authentication.

2. Scope SPF to what actually sends.

yourdomain.com.  TXT  "v=spf1 include:_spf.google.com ~all"

Add other legitimate senders; nothing else. An over-broad record authorises systems you no longer control and deep include chains risk the DNS lookup limit.

3. Publish DMARC.

_dmarc.yourdomain.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

4. Verify on a real message. Send to a mailbox on another provider and read the raw source:

dkim=pass header.i=@yourdomain.com;
spf=pass smtp.mailfrom=yourdomain.com;
dmarc=pass header.from=yourdomain.com

The value to check is header.i. If it names a Google domain rather than yours, your own key is not signing yet, and the console saying "authenticating" is not proof.

The connection itself

1. Start the connect flow and choose the Google option.
2. Sign in as the mailbox you are connecting — not as a superadmin, unless that mailbox is the one being warmed.
3. Review the requested scopes and consent.
4. Confirm the connection shows the right address, then let the tool verify it can send and read.

Connect the actual sending mailbox. Warm-up reputation is per mailbox as well as per domain, so warming info@ does nothing for sarah@.

Admin settings that block or break it

• Third-party app access controls. Workspace admins can restrict which apps may access Gmail data. If consent is refused or the app is marked unverified for your organisation, an admin must allow it in Security → Access and data control → API controls.
• Org-unit scoping. Access granted for one org unit does not apply to another; a mailbox moved between units can lose it.
• Suspended or licence-less accounts. A mailbox without an active licence cannot send.
• Legacy routing or relay rules. A rule that reroutes outbound mail can send some of it by a path that no longer aligns with your DKIM, which quietly undermines the ramp.
• Groups and aliases. An alias is not a mailbox. Connect the underlying account.

What to expect once it is running

• Start small and compound slowly. A handful of conversational sends for the first few days, then growth in modest proportions. Doubling daily is the pattern filters are built to catch.
• Replies are the point. A warm-up that only opens mail generates the weakest signal available; replies are the strongest, folder rescues next.
• Sends spread through the day. Burst traffic from a thin-reputation mailbox is the quickest route to a rate limit.
• No stopping and restarting hard. Reputation decays in silence, so a fortnight off means a fresh ramp.
• Verify by placement, not acceptance. Accepted mail includes spam-foldered mail. Seed tests tell you where it landed, and on Gmail they must break out the tabs, because Promotions carries the `INBOX` label and label-only checks overstate Primary.

Set up Postmaster Tools for the domain in parallel and watch spam rate against the 0.30% threshold, aiming under 0.10%, along with authentication and compliance status. Do not go looking for a reputation grade: the domain and IP reputation dashboards retired with v1, senders were redirected from 30 September 2025, and v1 was gone by the end of 2025, with v2 gaining a Deliverability analysis report in June 2026.

What not to do

• Do not connect with an app password workaround when OAuth is available. OAuth is revocable per app and does not expose a credential with full mailbox access.
• Do not connect a group or alias.
• Do not warm up one mailbox and send from another.
• Do not start a live campaign from a mailbox on day three of its ramp. The complaint risk lands on reputation that does not exist yet.
• Do not warm up by mailing colleagues on your own domain. Internal mail often bypasses filtering entirely.
• Do not skip the DKIM check because the admin console looks green. Headers on a received message are the only proof.

How MailPilot helps

MailPilot connects Google Workspace and Gmail mailboxes over OAuth — and SMTP/IMAP senders including SendGrid, Amazon SES, Mailgun, Postmark and custom hosts — checks SPF, DKIM and DMARC alignment on the sending domain before the ramp begins, and warms each mailbox with real conversations spread through the day. Placement is measured per provider with a seed-inbox network that reports Gmail's tabs separately, and per-mailbox reputation is tracked daily. Every plan includes unlimited mailboxes, so each sending address can have its own ramp.