Improving deliverability from Google Workspace

Google Workspace mail leaves from Google's IPs, which are well-maintained and well-trusted. That solves the infrastructure half and none of the rest. Reputation attaches to your domain, and your domain starts with nothing. Here is the order to work in.

1. Turn on DKIM — it is not on by default

This is the most common Workspace misconfiguration. A new Workspace domain sends without a DKIM signature of its own until an admin generates a key and publishes it.

1. In the Admin console, open Apps → Google Workspace → Gmail → Authenticate email.
2. Generate a key for the domain (use the 2048-bit option if offered).
3. Publish the supplied TXT record at the selector hostname in your DNS.
4. Return and start authentication.
5. Verify on a real received message, not in the console.

Verification means reading the headers of a message you sent to an outside mailbox:

Authentication-Results: mx.example.net;
 dkim=pass header.i=@yourdomain.com;
 spf=pass smtp.mailfrom=yourdomain.com;
 dmarc=pass header.from=yourdomain.com

header.i=@yourdomain.com is the thing to check. If it names a Google domain instead, your own key is not signing.

2. SPF and DMARC on the domain

SPF for a Workspace-only domain is short, and short is the point:

yourdomain.com.  TXT  "v=spf1 include:_spf.google.com ~all"

Add any other service that sends as your domain, and only those. An over-broad record authorises senders you no longer control, and deep include chains risk the DNS lookup limit. Then publish DMARC:

_dmarc.yourdomain.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

p=none satisfies the bulk-sender requirement while you read reports. Tighten to quarantine and then reject once the reports show every legitimate path aligning.

3. Check the admin settings that quietly hurt you

Workspace has a handful of options that affect how your outbound mail is treated or how your inbound filtering behaves. Worth auditing:

• Routing and SMTP relay rules. A legacy relay rule can send some of your mail by a path that no longer aligns with your DKIM or SPF.
• Catch-all addresses. A catch-all accepts mail for every nonexistent local part, which is an invitation to spam traffic and complaint noise on your domain.
• Default routing that forwards externally. Forwarded mail breaks SPF for the forwarded hop and can generate spam reports attributed to your domain.
• Groups configured as open to external senders, which become spam amplifiers.
• Comprehensive storage and audit settings, if you need to be able to reconstruct what was sent during an incident.

4. Respect the limits, and know which one applies

Google publishes send limits per account type, and exceeding them produces temporary failures rather than silent loss. The number that applies depends on whether you are sending through the Gmail interface, the Gmail API, or the Workspace SMTP relay, and on your edition and account age — trial and newly created accounts get lower caps. Check the limit for your own configuration in Google's documentation rather than assuming a figure from an article, and build your sending to sit comfortably under it rather than probing for it.

Practical rules that hold regardless of the exact number: spread sends through the day, do not batch at the top of the hour, and add mailboxes rather than pushing one mailbox to its ceiling.

5. Use a subdomain for outreach

Send cold campaigns from a subdomain — go.yourdomain.com — with its own DKIM key, rather than your main domain. Reputation is per domain, so a campaign that goes badly stays contained and your invoices and password resets keep arriving. The subdomain starts with no history, so warm it separately; it inherits very little from the parent.

6. Monitor what Google still reports

Verify the domain in Postmaster Tools and watch spam rate against the 0.30% bulk-sender threshold, with 0.10% as your working ceiling. Also watch authentication pass rates, delivery errors and compliance status, plus the Deliverability analysis report added in June 2026.

What you will not find is a reputation grade. Postmaster Tools v1 was retired — senders were redirected to v2 from 30 September 2025 and v1 was gone by the end of 2025 — and the domain and IP reputation dashboards are permanently gone. For placement you need seed testing, with Gmail's tabs read separately, because Promotions still carries the `INBOX` label and any label-based check overstates primary-tab delivery.

What not to do

• Do not assume Workspace handles authentication for you. DKIM needs an admin to generate and publish a key.
• Do not run a catch-all on a domain you send outreach from.
• Do not send cold campaigns from your root domain.
• Do not resume full volume after a quiet fortnight. Reputation decays; ramp again.
• Do not warm up by mailing colleagues on the same domain. Internal mail frequently bypasses filtering and teaches Gmail nothing about how strangers treat you.
• Do not chase spam-trigger words while a spam rate above 0.1% is burning the domain.

How MailPilot helps

MailPilot connects Google Workspace mailboxes over OAuth, warms them with real conversations — replies and folder rescues, not just opens — at a ramp spread through the day, and measures per-provider inbox placement with a seed-inbox network that reports Gmail's tabs separately. It checks SPF, DKIM and DMARC alignment on the sending domain, which is where the Workspace-specific failures almost always are, and tracks each mailbox's reputation daily.