I've just been given Google admin privileges for my organization, and the sales team has been reporting that emails sent from SDRs are constantly landing in recipients' spam folders. We have two domains set up, but no matter which one we use, the emails still get flagged as spam.
In the Google Admin console, under the Gmail settings for email authentication, I see that Google provides a DNS TXT DKIM key. I checked this in AWS, where our domain is hosted, and everything seems alright. I considered deleting the current one and creating a new DKIM record, but I'm worried about messing things up for the whole organization.
My questions are:
1. Can a missing or incomplete DKIM setup cause outbound emails to be marked as spam?
2. How do I properly set and validate DKIM for Google Workspace?
3. What tools or tests can I use to confirm my setup is correct?
I've tried searching online, but I'm not finding clear guidance.
**Update:** After running several tests, here's what I found:
- DKIM is published correctly (per MXToolbox)
- Real emails show SPF/DKIM/DMARC as passing (according to Gmail's original message view)
- Mail-tester score is 9.5 out of 10
- RedSift shows good deliverability across major email providers
- SPF is valid with a single record
- DMARC is in place and fully aligned.
Despite all this, I still see a message in the Admin console indicating I must update the DNS records for DKIM authentication. Can anyone help clarify why that is?
4 Answers
Yes, an incomplete DKIM setup can definitely lead to your emails ending up in spam, especially if your domain has a bad reputation. Once you've generated the DKIM key correctly and published it in your DNS, make sure you click the button in Google admin to start authenticating those emails. Also, consider double-checking your SPF as it can influence deliverability too. It sounds like you're doing a lot of the right checks already; just ensure everything is properly published.
I confirmed everything looks good with the SPF setup too.
It's crucial to check the email headers when you send yourself a test email. Look for SPF and DKIM results there; they should indicate if they passed or failed. This can give you more insight into what might be going wrong.
I checked the headers, and both SPF and DKIM passed!
Make sure you get the email headers from the spam folder. They can be loaded into tools like MXToolbox for better analysis of why it's landing in spam. Sometimes, specific configurations can trigger spam filters even if your authentication setups are correct.
I appreciate the tip! I'll ask the team to retrieve those headers.
You might want to use tools like MXToolbox or Mail Tester to verify if the DKIM is properly publishing at your DNS provider. Missing or misconfigured DNS records can happen—if you're unsure, consider setting up a test Google Workspace account to experiment without risking the main setup. Also, subdomains don't inherit DKIM from parent domains, so check that if applicable.
I ran the MXToolbox test, and it seems to indicate everything is fine on that end.
Thanks for the info! I'll verify the SPF as well.