Google Workspace Setup for Cold Email — Step-by-Step Guide

What you need before you start

Before you click anything in Google’s signup flow, gather three things. Cold email setup goes wrong almost always because one of these was missing and the operator improvised.

• A domain you control. Either a freshly registered alt-domain (recommended for cold email so your primary brand domain never carries the outbound risk) or an existing domain whose DNS you can edit. You need full DNS access at the registrar — not just “I own the domain” but “I can publish arbitrary TXT, MX, and CNAME records on it today.” If your domain is locked behind a corporate IT ticket queue, that is the bottleneck to fix first.
• Registrar dashboard access. Confirm you can log in to the registrar (NameCheap, Cloudflare, Porkbun, GoDaddy, etc.), navigate to the DNS editor for the specific domain, and that the registrar has not parked DNS at a third-party host you do not control. The most common Workspace setup failure is publishing records at the wrong DNS provider — the registrar shows them, but the authoritative nameservers are elsewhere.
• A payment method. Google Workspace requires a card on file before provisioning. Use a card connected to the entity that will own the mailboxes long term. Personal cards on company tenants cause billing-recovery issues a year later when the card expires and the tenant suspends mid-campaign.

You should also have decided your persona structure before you start. Cold email mailboxes are sender personas: real human names with realistic titles that map to people on your team or to fictional but consistent identities. Decide the names, the titles, and the signatures before you create the users — backfilling this later means re-warming each mailbox.

Step 1: Buy a domain (5 minutes)

The best registrars for cold email alt-domains are Cloudflare Registrar(at-cost pricing, automatic DNSSEC, fastest DNS in the industry), NameCheap (cheapest first-year promos, good DNS UI), and Porkbun (transparent pricing, no upsells). Avoid GoDaddy for cold email — their DNS is slow to propagate, their UI nags you with upsells, and their email-related TLDs are sometimes flagged by recipient spam filters because of how many cheap throwaway domains have been registered there.

Google Domains was sunset in 2023 and migrated to Squarespace; we do not recommend Squarespace as a registrar for cold email infrastructure because the DNS editor is slower and offers fewer record-type options.

On TLDs: stick with .com as a default. .io, .co, .ai, and .net are acceptable alt-domain extensions because mainstream B2B brands use them. Avoid the cheap TLDs — .xyz, .top, .click, .info — because they are massively over-represented in spam corpora and major recipient filters apply baseline negative reputation to mail from those zones. The $2 you save on registration is paid back as a 30 percent spam rate.

Naming pattern: pick alt-domains that read like real companies. A common pattern is prepending or appending a word to your brand: tryacme.com, getacme.io, acmehq.com. Another is using a shorter or alternative spelling: acme.io, acmecorp.co. Avoid dashes-in-names, double letters, and numbers: those patterns are over-represented in throwaway domains.

Read the deeper guide: Cold email infrastructure 101 covers domain strategy at the portfolio level (how many alt-domains for how many mailboxes, when to retire one, how to age them).

Step 2: Sign up for Google Workspace (10 minutes)

Go to workspace.google.com. Click Get started. The signup flow asks four things: business name, employee count, region, and a contact name and email. The contact email is the temporary admin login used until your domain is verified — use a personal Gmail you actually monitor, because Google sends the verification confirmations there.

When asked “Does your business have a domain?”, choose Yes, I have one I can use and enter the alt-domain you registered in Step 1. Do not let Google sell you a domain through their flow — the upsell goes to Squarespace, the price is higher, and you lose direct DNS control which is exactly what you need for the rest of this guide.

Business Starter vs Business Standard

Pick Business Starter. The 30 GB mailbox is more than any cold email persona will ever fill, the daily external send cap is identical at 2,000 recipients per 24 hours on both plans, and the deliverability stack — SPF, DKIM, DMARC, OAuth, App Passwords — is the same. Business Standard exists for teams that actually use Drive and Meet; cold email mailboxes do neither.

Step 3: Verify domain ownership (5 minutes)

After payment, Google’s setup wizard prompts you to verify the domain. Choose the TXT record method — it is the most reliable and survives DNS provider changes. Google generates a string that looks like google-site-verification=abc123XYZ….

1. Copy the full TXT value Google shows you.
2. In your registrar’s DNS editor, add a new record with type TXT, host @ (or your apex domain, depending on registrar convention), and value equal to the string Google gave you.
3. Set TTL to 300 (5 minutes) so propagation is fast. Save the record.
4. Return to Google’s wizard and click Verify. If verification fails on first attempt, wait 60 seconds and click again. Cloudflare and NameCheap usually propagate in under two minutes; GoDaddy can take 30.

Need to inspect what is actually published? Use our free SPF and TXT record lookup tool to confirm the TXT is live before retrying.

Step 4: Configure MX records (5 minutes)

MX records tell the world which servers receive mail for your domain. Until MX is correct, replies to your cold email bounce. Delete every existing MX record at the registrar before adding Google’s, including any “default” MX the registrar set on registration.

All five records use host @ (the apex). Some registrars require a trailing dot on the host value (ASPMX.L.GOOGLE.COM.) and some forbid it; copy the format the registrar already uses for any existing MX. Set TTL to 3600 once you confirm the records resolve. Verify with dig MX yourdomain.com or our inbox placement tester.

Step 5: Configure SPF record

SPF authorises Google’s servers to send mail on behalf of your domain. Publish a single TXT record at the apex:

v=spf1 include:_spf.google.com ~all

Two rules to internalise. First, only one SPF record per domain. If you already have an SPF record for your existing transactional sender (Postmark, SendGrid, Mailgun), merge into a single record by adding the include: mechanism: v=spf1 include:_spf.google.com include:sendgrid.net ~all. Two SPF records is a hard SPF failure for every receiver. Second, the policy qualifier ~all (soft-fail) is correct for cold email; do not use -all (hard-fail) until your DMARC reports show zero false positives, which usually means after two weeks of clean reports.

Validate immediately with our free SPF checker or run dig TXT yourdomain.com.

Step 6: Enable + configure DKIM (5 minutes)

DKIM cryptographically signs every outbound message and is the strongest signal you can publish. Workspace generates the key for you; you publish the public half at the registrar.

1. In Google Admin Console, go to Apps → Google Workspace → Gmail → Authenticate Email.
2. Select your domain in the dropdown. If multiple sending domains exist on the tenant, repeat for each.
3. Click Generate New Record. Choose 2048-bit key length (the default since 2023). Use prefix selector google.
4. Google displays the host (google._domainkey) and the TXT value (v=DKIM1; k=rsa; p=…very-long-string…). Copy both.
5. In your registrar DNS editor, add a TXT record with host google._domainkey and the value Google provided. Some registrars truncate long TXT values — if so, split into 255-character chunks wrapped in quotes per RFC 7208.
6. Wait 1–4 hours for propagation, return to Admin Console and click Start Authentication. Status should change from Not authenticating to Authenticating email.

Confirm the public key resolves with our DKIM checker. If you skip this verification step you will discover misconfigured DKIM only when your DMARC reports start arriving in week two — by which point your reputation has already taken a hit.

Step 7: Add DMARC record

DMARC tells receivers what to do when SPF or DKIM fail. Start permissive and tighten over time. Publish a single TXT record at host _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=r; aspf=r

Why p=none on day one: a quarantine or reject policy before you have validated SPF and DKIM with real mail flow risks bouncing legitimate outbound. Run p=none for two weeks while you ingest the daily DMARC aggregate reports (rua) and confirm 100 percent DKIM and SPF pass rates. Then move to p=quarantine; pct=10, ramp percentage weekly, and graduate to p=reject. Validate with our DMARC checker.

For a deeper dive into DNS authentication design, see our DNS setup guide and domain DNS setup product page.

Step 8: Create users / mailboxes (1–2 minutes per mailbox, manual)

In Admin Console, navigate to Directory → Users → Add new user. For each persona enter first name, last name, primary email address (use first.last@yourdomain.com — it is the most natural-looking format and matches the convention every B2B contact database expects), set a strong initial password, and choose the Outbound organisational unit you created earlier.

Two to three sending mailboxes per domain is the sweet spot. More than that concentrates reputation risk on a single domain; fewer wastes the SPF/DKIM/DMARC setup overhead. If you need ten sending personas, register five domains with two mailboxes each rather than one domain with ten.

Each mailbox creation is a 1–2 minute interactive flow: type name, type email, set password, set OU, save, repeat. There is no native bulk-create UI for cold email cohorts. Google’s CSV bulk-upload exists but does not handle the post-creation steps (sender profile, signature, avatar, OAuth) so you still touch every mailbox individually for those.

Step 9: Set up sender names + signatures + avatars

The mailbox is created, but it does not look like a real person yet. Receiving spam filters and the prospects themselves rely heavily on visible sender metadata.

• Display name. Set to Firstname Lastname exactly as the email address implies. Mismatched display names (“John Smith” on jane.doe@) are a known phishing signal.
• Profile photo. Upload a real-looking professional headshot. Stock photography is detectable; consider This Person Does Not Exist generations or licensed photo packs. Plain default initials avatars look low-effort and reduce reply rates measurably.
• Signature. Set in Gmail → Settings → General → Signature. Three to four lines: name, title, company, and a single CTA (calendar link or website). No images, no banner graphics, no tracking pixels in the signature. Signature images break image-loading filters and tracking pixels in signatures are flagged by the major filters.
• Time zone. Set the user’s time zone in their account settings to match the persona’s claimed location. Outbound from a New York persona at 03:00 Eastern is a reputation hit even if every other signal is clean.

Step 10: Connect to sequencer

Two integration methods, in order of preference: OAuth and App Password + IMAP/SMTP.

OAuth is the right default. Sequencers like Smartlead, Instantly, Lemlist, and Apollo all support “Connect with Google”. The mailbox owner clicks through Google’s consent screen, the sequencer stores a refresh token, and the connection survives password rotations and 2FA enforcement transparently. OAuth tokens also avoid the App Password rate-limiting that hits IMAP/SMTP at scale.

App Password + IMAP/SMTP is the fallback for sequencers that do not support OAuth. Generate a 16-character App Password from myaccount.google.com → Security → App passwords (requires 2FA enabled first). Use the IMAP and SMTP settings below.

Enable IMAP first — it is off by default on new Workspace mailboxes. Open Gmail → Settings → See all settings → Forwarding and POP/IMAP → Enable IMAP → Save. Without this step every IMAP connection rejects with “invalid credentials”, even when credentials are correct.

Once connected, run two to three weeks of warmup before any real outreach. See our email warmup guide for the ramp curve and target metrics. View all supported integrations on the integrations page.

Bulk path: what 30 manual setups looks like vs StackMail's automated flow

The ten steps above take a confident operator about 45–60 minutes per first mailbox on a fresh domain, and roughly 25–30 minutes per additional mailbox on the same domain (DNS only happens once per domain). Multiply by 30 sending mailboxes spread across 15 alt-domains and the manual path becomes:

• 15 domain registrations: ~75 minutes
• 15 Workspace tenant signups: ~150 minutes
• 15 × (verify + MX + SPF + DKIM + DMARC) DNS rounds: ~225 minutes
• 30 user creations + sender profiles + avatars + signatures: ~450 minutes
• 30 OAuth or App Password sequencer connections: ~150 minutes
• Debugging DNS propagation, DKIM TXT splits, App Password 2FA flows: ~120–200 minutes

Total: roughly 19–23 hours of focused clicking for thirty mailboxes done correctly. The error rate matters more than the time. We have audited dozens of agency-built fleets and the modal misconfiguration is one or two of the fifteen domains shipping with broken DKIM — silently — because the operator skipped the propagation-check step on a long day. Those mailboxes ship hard at week two when DMARC reports surface the misalignment.

StackMail’s automated provisioning runs the same ten steps as a backend pipeline. You enter the domains and the persona names; we register the domains via reseller, sign up Workspace tenants, publish DNS through the registrar API, generate the DKIM key, create users, set sender profiles and signatures from your template, generate App Passwords or OAuth tokens, and post the credentials to your sequencer. Per mailbox: under three minutes. Per cohort of thirty: roughly 90 minutes wall-clock with you watching, zero clicks. See pricing at our Google Workspace product page or compare with Microsoft 365 mailboxes for IP diversification. Agencies running this at client scale should see our agency setup guide.

Comparing infrastructure providers? Read our honest write-ups on the major players: InboxKit alternatives, Mailforge alternatives, or browse the full alternatives hub.

Common errors + fixes

Five Google Workspace gotchas we see weekly, in order of frequency.

FAQs