Google Workspace Emails Going to Spam? Fix Authentication First

Last updated: October 2026

Your domain is on Google Workspace, your mail looks professional, and yet clients keep finding your messages in their spam folders — sometimes even in other Gmail inboxes, which feels like a betrayal by your own provider. The uncomfortable truth: paying for Google Workspace does not authenticate your domain. Google verifies mail it receives very strictly, including yours. If your domain's records are incomplete, Gmail-to-Gmail mail gets filtered like anyone else's.

Run this test first. Send a message from your business address to a personal Gmail address, open it, click the three dots → "Show original." Look at the SPF, DKIM and DMARC rows. This guide is the fix for whichever row doesn't say PASS.

Check 1: SPF — one record, and it must include Google

Your domain root needs exactly one TXT record starting v=spf1, and it must contain include:_spf.google.com. Google's include is efficient — resolved live, its record is pure IP ranges, so it costs exactly 1 of your 10 allowed DNS lookups.

The two classic failures: no record at all (domains set up by hand years ago, or migrated between hosts, sometimes simply never got one), and two records (a registrar's default plus one someone added later) — which receivers treat as a permerror, as if you had none. Whatever else sends as your domain — newsletter tool, invoicing app, website forms — belongs merged into this same single record. If the merge pushes you toward 10 lookups, see the lookup-limit guide before adding anything else.

Check 2: DKIM — the step most Workspace domains never finished

This is the big one. In Google Workspace, DKIM signing for your domain does not start by itself. Someone with admin access has to generate a key and explicitly start authentication — and on a large share of small-business domains, nobody ever did. The mail still sends. It just sends unsigned.

1. Open the Google Admin console (admin.google.com) → Apps → Google Workspace → Gmail → Authenticate email.
2. Select your domain and click "Generate new record." Choose the 2048-bit key length (the stronger option Google offers). The DKIM selector prefix defaults to google.
3. Google shows a TXT record: host google._domainkey, value beginning v=DKIM1; k=rsa; p=…. Publish it in your DNS exactly as shown.
4. Wait a few minutes for the record to be visible, then return to the same console page and click "Start authentication." Until this step succeeds, nothing is signed.
5. Verify: send a test to Gmail and check "Show original" — DKIM should now read PASS with your domain.

Two traps: the record must be published in the DNS panel your nameservers actually point to (not wherever you originally bought the domain, if those differ), and long 2048-bit values must be pasted complete — a truncated key fails silently and the console's "Start authentication" will keep erroring until DNS shows the full record.

Check 3: DMARC — the record that makes the other two count

With SPF and DKIM passing, publish DMARC so receivers apply a policy to your domain and send you reports. Start at monitoring:

Stay at p=none while reports prove every sender passes — including the ones outside Google (your newsletter platform needs its own DKIM; here's the Mailchimp walkthrough). Then climb: quarantine, then reject. The full staged process is in our DMARC setup guide, and the policy differences are unpacked in p=none vs p=quarantine vs p=reject.

If all three pass and mail still lands in spam

Then authentication was never your (only) problem, and the cause sits in reputation or engagement: recipients marking mail as spam (keep the rate under 0.3% — Google's stated ceiling — and ideally under 0.1%), cold outreach from a business domain, purchased lists, or a sudden volume jump. Check Google Postmaster Tools (free; register your domain) to see your domain reputation and spam rate as Google sees them. One separation that pays for itself: send marketing from a subdomain (news.yourdomain.com) so its reputation can never drag your invoices and client mail down with it.