How to set up Google Workspace for cold email, and what it costs you in hours

A Google Workspace inbox that can send cold email is not just an account. It is a verified domain, five DNS records that have to agree with each other, a DKIM key that has to be generated and then switched on, users with real sender names, and a connection to your sequencer that Google will refuse if one setting is wrong. None of it is hard. All of it is easy to get slightly wrong, and slightly wrong fails silently.

This is the whole setup, in order, with a rough count of the hands-on time each step takes. If you decide at the end that the hours are better spent elsewhere, the last section covers that too.

What does a Google Workspace cold email setup involve?

Seven stages per domain: buy the domain, sign up for Workspace and verify the domain, point MX at Google, publish SPF, generate and start DKIM, publish DMARC, then create the users and connect them to a sequencer. The DNS work is the part that decides whether mail arrives, and it is the part that gives no error when it is wrong.

Those figures are our estimate for someone who has done it before, and they leave out the waiting: DNS changes take minutes to hours to be visible, and Google may not let you generate a DKIM key until Gmail has been active on the domain for a while. Call it two to three hours of work per domain, spread across a day or two.

That is the number that matters, because Google volume comes from adding domains. At 15 campaign sends per inbox and 3 inboxes per domain, 450 sends a day is 10 domains, and 10 domains is 20 to 30 hours of setup before the first campaign email. The reasoning behind 3 per domain is in how many Google inboxes per domain.

Step 1: which domain should you send cold email from?

Never your main business domain. Register separate sending domains that read like your brand, so a reputation problem on a sending domain never reaches the domain your invoices, support and customers depend on. Domain choice, naming and how many to hold are covered in cold email domain strategy.

A brand-new domain also should not send on day one. Spamhaus lists very young domains, so give a new registration at least 24 hours before anything goes out, and read how soon a new domain can send for the rest of that timeline.

Step 2: signing up and verifying the domain

Sign up for Google Workspace with the sending domain, add billing, and Google gives you a TXT record that proves you control the domain. Publish it at the root of the domain at your DNS host and confirm in the Admin console. Verification usually completes within the hour; occasionally it takes longer while the record propagates.

A decision hides in this step. Workspace lets you add more domains to one account as secondary domains, and it is tempting, because it is one bill and one Admin console. It also means every domain shares one account. If that account is suspended, every domain in it stops sending on the same day, which is the blast radius separate domains were supposed to remove.

Step 3: what MX records does Google Workspace need?

One. Google’s current setup is a single MX record pointing at smtp.google.com with priority 1. Delete any MX records the registrar created by default, because a leftover MX pointing at the registrar’s parking mail server sends some of your replies somewhere you will never read them.

Type: MX   Host: @   Value: smtp.google.com   Priority: 1

Step 4: the SPF record for Google Workspace

SPF lists the servers allowed to send for the domain. For a domain that only sends through Google it is one TXT record at the root. The mistake is not writing it, it is ending up with two: a registrar default plus yours. Two SPF records is a permanent error, and a receiver treats the domain as having no valid SPF at all.

Type: TXT   Host: @   Value: v=spf1 include:_spf.google.com ~all

If anything else sends for the domain, it goes into the same record, and the whole record has to stay under SPF’s limit of ten DNS lookups. The full rules are in SPF, DKIM and DMARC for cold email, and the SPF checker counts the lookups for you.

Step 5: how do you set up DKIM in Google Workspace?

In the Admin console, open Apps, Google Workspace, Gmail, Authenticate email. Pick the domain, generate a 2048-bit key with the default selector google, and publish the value it shows as a TXT record at google._domainkey. Then go back and press Start authentication. Publishing the record does nothing on its own.

Type: TXT   Host: google._domainkey   Value: v=DKIM1; k=rsa; p=MIIBIjANBgkq... (the full key from the Admin console)

Two things go wrong here more than anywhere else. The first is forgetting Start authentication: the key is in DNS, every lookup tool shows it, and Google is still sending the mail unsigned. The second is a DNS host that silently cuts long TXT values, which a 2048-bit key is. The record looks published, the key is truncated, and DKIM fails on every message. If your DNS host has a length limit, split the value into quoted strings or generate a 1024-bit key instead.

Step 6: what DMARC policy should a cold email domain use?

Start at p=none with a report address, so you see what receivers see without asking them to reject anything. Google’s sender requirements expect a DMARC record for anyone sending in volume to Gmail, and a domain without one looks unfinished. Move to quarantine only once the reports show SPF or DKIM aligning on everything you send.

Type: TXT   Host: _dmarc   Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

The expensive mistake is the opposite one: copying p=reject from a guide before DKIM is actually signing. Every message that fails alignment is then refused outright, and from the sending side it looks like the campaign simply went quiet.

Step 7: creating the users and connecting them

Create up to three users on the domain with real first and last names, because the sender name is the first thing a prospect reads. Then each account has to be connected to your sequencer, either by OAuth, which may need you to trust the sequencer’s app in the Admin console, or by an app password, which needs 2-Step Verification on every account. The detail, and the errors each route produces, is in connecting Google Workspace to your sequencer.

Once connected, set each inbox to the volume it is sized for. We size a Google inbox for 15 campaign emails a day plus about 20 warm-up sends, and ramp to that rather than starting there. Gmail sending limits for cold email separates what Google permits from what is safe.

How do you check the setup actually works?

Look up every record from outside, not in the place you typed it. The DNS records checker reads SPF, DKIM, DMARC and MX for up to 25 domains in one pass, which matters when the pool is ten domains rather than one. Then send a test from each account to a mailbox you control and read the headers: spf=pass, dkim=pass and dmarc=pass, with the DKIM signature on your domain rather than a Google default.

The mistakes that take down a whole pool

A single domain set up wrong is a bad week. The real risk is that setups are copied. Nobody builds domain seven from first principles, they repeat domain one, so whatever is wrong on the first is wrong on all of them, and it shows up as a reply rate that falls everywhere at once rather than an error anywhere.

Every row has the same shape: nothing on the screen says it is wrong. That is why the checking step is not optional, and why it has to be repeated for every domain rather than assumed from the first.

Doing it yourself or buying it done

Doing it yourself makes sense when you want to pay Google directly, run one or two domains, and have the afternoon. That is $7 to $8.40 per user per month on Business Starter, as set out in Google Workspace pricing for cold email.

Buying it done makes sense when the domains are the means rather than the job. You still own the domain and the reputation built on it. You also get full admin access, including the Admin console, for as long as the subscription is active. What you get on top is the part this whole article is about, checked before you receive it rather than discovered three weeks into a campaign. We do not claim Google mail lands better than Microsoft mail; we have not measured a difference and the choice is yours.