How do I set up my sending domain?

Set up SPF, DKIM, and DMARC for the domain after @ in your Google Workspace address. A free @gmail.com mailbox has no domain of its own, so these steps do not apply to it.

You need access to the domain’s DNS provider. DKIM also requires access to Google Admin.

Open the sending domain screen

1. Open Settings, then Accounts.
2. Find a Google Workspace mailbox.
3. Select its domain badge.

Mailboxes on the same domain share these records, so you configure the domain once.

The three records

Record	Where the value comes from
SPF	ColdMerge shows the TXT host and value to publish
DKIM	Google Admin generates the TXT host and value
DMARC	ColdMerge shows a safe starting TXT host and value

Caution

If your domain already has an SPF record beginning with v=spf1, edit that record. Do not publish a second SPF record.

Publish SPF

1. Read the SPF card’s status, then open your domain provider’s DNS settings.
2. For Not found, copy the supplied Host and Value into a new TXT record.
3. For Google not authorized, edit your existing SPF record to include include:_spf.google.com. Keep the other senders you use.
4. For Multiple records, merge the authorized senders into one SPF record. Do not add another record.
5. For Needs review, select Re-check now before changing your record.
6. Save any corrections, then select Re-check now.

Publish DKIM

1. In Google Admin, open Apps, Google Workspace, Gmail, then Authenticate email.
2. Choose the domain and generate a record.
3. Add the generated host and value as a TXT record at your DNS provider.
4. Return to Google Admin and select Start authentication.

Google does not sign mail with the domain until the last step is complete.

Publish DMARC

1. In the DMARC card, copy Host and Value.
2. Add them as a TXT record at your DNS provider.
3. Save the record.

Start with the value ColdMerge supplies. If you already have a DMARC record, edit it carefully instead of replacing reporting addresses or other tags.

12

The numbered dots in this screenshot

1. Copy the DNS record Host.
2. Copy the DNS record Value.

Re-check

Leave the domain’s page open after publishing the records. Until every signal passes, it re-checks every 30 seconds for up to 15 minutes, only while the tab is in front, and shows Checking automatically… under Re-check now. Select Re-check now to check at once. If it says Still waiting, your DNS has not updated yet; re-check once it has. ColdMerge also re-checks connected sending domains each day.

When every signal passes, the page shows Healthy. Use Sending-domain statuses to interpret any other result.

Trial email timing

ColdMerge may remind you when a trial domain is not Healthy:

• The first tip becomes due 24 hours after your first campaign message sends.
• The second becomes due 48 hours after the first tip was successfully sent. It includes your SPF and DMARC values plus Google Admin DKIM instructions, ready to forward to whoever manages your DNS.
• Tips leave from 08:00 to 19:00 in your local timezone, at least 24 hours apart.
• ColdMerge sends at most three tips or product-news emails in any rolling seven days.
• Each DNS tip expires after 24 hours. The first sends only before the trial reaches three days old. A successfully sent first tip can still produce its promised second tip; the second is not sent if the first did not send successfully.

Fix an unaligned DKIM

If DKIM shows Not aligned, follow the Google Admin steps above and make sure you selected Start authentication. See the troubleshooting guide for details.

Fix a weak policy

If SPF or DMARC shows Weak policy, your record is valid but permissive. See How do I fix a weak policy?.

If everything is failing at once

Set up DKIM first, then SPF, then DMARC. Re-check after each change so you know which record fixed each signal.

What these records do

For a plain-language explanation, see Why do SPF, DKIM, and DMARC matter?.