How to Set Up Google Workspace for Cold Email

Google Workspace is the foundation of most cold email infrastructure. It has better inbox placement than free Gmail, supports full DNS authentication, plays well with every warmup tool, and integrates cleanly with Instantly, SmartLead, and Lemlist. This guide walks through setup from domain purchase to first campaign send.

Step 1: Buy a Sending Domain

Never send cold email from your main company domain. If your main domain is acme.com, do not put cold email sending on acme.com. One deliverability issue -- a spam complaint, a bounce spike, a Google manual action -- affects every email from that domain, including transactional emails, support replies, and sales conversations. It is not worth the risk.

Buy a sending domain that is a readable variation of your main brand. Common patterns:

• tryacme.com or getacme.com -- the most common pattern, signals a brand
• acmehq.com or acmeteam.com -- slightly more formal
• firstnamelastname.com for founder-led outreach -- creates a personal feel
• acme.io or acme.co if the .com variation is taken

Domains typically cost $10-15/year from Google Domains, Namecheap, or Cloudflare Registrar. Buy 2-3 sending domains from the start if you plan to scale to multiple mailboxes -- spreading sending volume across domains improves deliverability. Plan for one domain per 2-3 mailboxes at moderate volume.

Step 2: Set Up Google Workspace

Go to workspace.google.com and start the Business Starter setup with your sending domain. Business Starter at $6/user/month is sufficient for cold email. It includes full DNS authentication support, SMTP access, and all the inbox features you need. You do not need Business Standard ($12/user/month) or Business Plus -- the upgrade does not improve deliverability.

One Google Workspace account per sending domain. If you are setting up three sending domains, you create three separate Google Workspace organizations. Each is billed independently. Most cold email operators pay $6-18/month in Workspace fees per domain depending on how many mailboxes they run on each domain.

Step 3: Configure DNS Records

Three DNS records are required before you send a single cold email. Missing any of them guarantees deliverability problems.

SPF Record

SPF (Sender Policy Framework) tells receiving mail servers which servers are authorized to send email from your domain. For Google Workspace, the record is:

Type: TXT | Host: @ (root domain) | Value: v=spf1 include:_spf.google.com ~all

The ~all at the end means 'soft fail' -- mail from servers not listed is accepted but marked as potentially suspicious. Do not use -all (hard fail) on a new domain -- it can cause legitimate emails to be rejected during the initial period.

DKIM Record

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails that receiving servers use to verify the email was not tampered with in transit. In Google Workspace Admin (admin.google.com): go to Apps > Google Workspace > Gmail > Authenticate email. Generate a 2048-bit key (not 1024-bit -- use 2048). Google will give you a DNS record to add:

Type: TXT | Host: google._domainkey | Value: (the key Google generates, starts with v=DKIM1; k=rsa; p=...)

After adding the DNS record, return to Google Admin and click 'Start Authentication'. DNS propagation takes 24-48 hours. Google Admin will show a green check when DKIM is active.

DMARC Record

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving servers what to do with emails that fail SPF or DKIM checks. Start with a monitoring-only policy:

Type: TXT | Host: _dmarc | Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none means no action is taken on failing emails -- you just receive reports. After 2 weeks of monitoring with no issues, move to p=quarantine (sends failing emails to spam instead of inbox). After another 2 weeks, consider p=reject. Most cold email operators stay at p=quarantine permanently. The rua address receives DMARC aggregate reports -- create a mailbox at that address or use a free DMARC report tool like dmarcian.

Step 4: Complete the Mailbox

Before warming up, each mailbox needs to look like a real person's email account. Deliverability algorithms check these signals:

1. 1Set a real display name: use an actual person's name (firstname.lastname@domain.com). Avoid role addresses like outreach@ or hello@.
2. 2Add a profile photo: a professional headshot. Gmail accounts with photos have measurably better deliverability than blank accounts.
3. 3Write an email signature: include full name, title, company name, and website. Simple text signature -- no images, no HTML tables. Image-heavy signatures trigger spam filters.
4. 4Enable two-step verification: Google is more likely to suspend accounts without 2FA active.
5. 5Send and receive a few test emails: manually send 5-10 emails to personal email addresses and reply from them before connecting to a warmup tool.

Step 5: Connect to a Warmup Tool

Warmup tools automatically send and receive emails between a network of accounts to build sending reputation before you start cold outreach. The two most common options:

• Instantly Warmup (included in Instantly plans, or $15/mo standalone): large warmup network, simple setup, tight integration with Instantly campaigns. Connect via OAuth (not SMTP password) for best results.
• Mailwarm ($19-29/mo): dedicated warmup tool, solid reputation, flexible configuration. Connect via SMTP or OAuth.

To connect Google Workspace to a warmup tool via OAuth: the tool will prompt you to authorize access to your Google account. Grant access and select the mailbox. For SMTP connection: in Google Admin, ensure SMTP relay is enabled. Use smtp.gmail.com, port 587 (TLS), with your Gmail address and an App Password (not your account password) -- generate App Passwords under your Google Account security settings.

Step 6: Wait 14-21 Days for Warmup

There is no shortcut here. 14 days is the absolute minimum. 21 days is better. The warmup tool will gradually increase sending volume from 5-10 emails/day in week 1 to 30-50 emails/day by week 3. Do not send cold email before the warmup period ends. A new domain that sends volume spikes before it has built reputation will land in spam or get flagged by Google.

Step 7: Connect to Your Cold Email Platform

After warmup, connect your mailbox to Instantly, SmartLead, or Lemlist. All three support both OAuth and SMTP connection for Google Workspace.

• OAuth connection (preferred for Google Workspace): click 'Connect mailbox', choose Google, authorize through OAuth. The platform gets a secure token that does not expire with password changes.
• SMTP connection (use when OAuth fails): smtp.gmail.com, port 587, TLS enabled, username = your full Gmail address, password = App Password generated from Google Account security settings (not your regular Gmail password).

Set daily sending limits in the platform to match your warmup ramp. Start at 20-30 emails/day per mailbox for the first two weeks of cold sending. Increase by 10-15/day per week up to your target volume (typically 40-50/day max per mailbox for sustained cold sending).

Common Mistakes

• Skipping DMARC: SPF and DKIM alone are not enough. DMARC is required for full authentication and is now a sending requirement for bulk senders to Gmail and Yahoo.
• Upgrading plan mid-campaign: switching from Business Starter to Business Standard sends a spike signal to Google's abuse detection. Stick with the plan you start with for at least 90 days.
• Using the primary domain: the most common and most damaging mistake. Never put cold email sending on your main company domain.
• Enabling 'less secure app access': this setting was deprecated by Google in 2024. Do not look for it -- use App Passwords or OAuth instead.
• Sending before warmup is complete: the warmup period is fixed infrastructure, not optional. Skipping it produces deliverability problems that can take months to recover from.

The Microsoft Split

Set up some of your mailboxes on Microsoft 365 ($6/user/month, Business Basic) in addition to Google Workspace. Outlook and Microsoft email servers prefer to deliver email from Microsoft infrastructure. If a significant percentage of your target list uses Outlook (common in enterprise, government, and manufacturing), Google-sent emails have lower placement rates to Outlook inboxes than Microsoft-sent emails do.

A common split for mixed-list campaigns: 60% Google Workspace mailboxes, 40% Microsoft 365 mailboxes. The setup process for Microsoft 365 is nearly identical -- SPF, DKIM, DMARC configuration, warmup, platform connection -- just on the Microsoft infrastructure instead of Google's.

Total Cost Breakdown