"A quotation email sent to a prospective client landed in their spam folder unnoticed, putting a crucial deal at risk"—this was a recent inquiry from a sales representative at a 20-person firm. Not long before, the same firm had consulted us about another incident: "Customers received suspicious phishing emails spoofing our company name, prompting inquiries." While seemingly unrelated, both issues share the same underlying root cause: email authentication is not properly configured on the company's custom domain.
For SMBs running corporate email on custom domains, this problem compounds quietly. Because emails appear to deliver without issue in everyday operations, the vulnerability remains hidden until surfacing as a critical delivery failure or a spoofing attack. This article breaks down why delivery issues and spoofing occur, detailing the safe sequence for configuring email authentication in Google Workspace from an implementation partner's perspective.
Delivery failures and spoofing stem from the same root cause
First, recognize that both issues share identical roots.
Receiving mail servers—most notably Gmail—automatically verify whether incoming messages genuinely originate from the purported domain. The mechanism driving this check is email authentication. When messages arrive from an unauthenticated domain, receiving servers cannot verify the sender's identity. Unverifiable emails are routed to spam folders as a defensive measure. This is the root cause of delivery failures.
Simultaneously, domains lacking authentication remain defenseless against third-party sender spoofing. When malicious actors forge your company's domain in the "From" header, receiving servers lack grounds to detect the fraud. Consequently, fraudulent messages land in customer and partner inboxes. This is the root cause of domain spoofing.
Email authentication functions both to ensure legitimate corporate emails reach inboxes and to block malicious impersonation attempts. A single configuration handles both inbound defense and outbound deliverability. Conversely, leaving it unconfigured leaves both flanks exposed.
SPF, DKIM, and DMARC perform distinctly different jobs
Email authentication is frequently bundled under three acronyms: SPF, DKIM, and DMARC. Because their names sound technical and advice is often reduced to "set up all three," their distinct roles are frequently misunderstood and left unattended. Let us distinguish their individual functions.
| How it works | Function | Consequence if missing |
|---|---|---|
| SPF | Declares authorized sending servers in DNS records | Legitimate mail cannot be distinguished from spoofed third-party servers |
| DKIM | Attaches cryptographic signatures to verify sender identity and prevent tampering | Transit tampering and spoofed headers go undetected |
| DMARC | Instructs receivers how to handle messages that fail SPF or DKIM checks | Receivers take no enforcement action when authentication fails |
SPF is a declaration stating, "Emails for this domain originate exclusively from these listed servers." If using Google Workspace, you add a single TXT record authorizing Google's outbound mail servers to your DNS. DKIM attaches a cryptographic digital signature to outbound messages, enabling receivers to verify that the message originated from the stated domain and arrived without transit modification.
DMARC serves as the critical keystone. It is a protocol directing receiving servers on how to handle messages failing SPF or DKIM verification. Policies operate across three progressive tiers: none (monitoring only, take no action), quarantine (quarantine into spam folders), and reject (reject outright). Major email providers like Gmail increasingly require DMARC compliance and actively apply quarantine policies against spoofed traffic. If SPF and DKIM provide the authentication ingredients, DMARC supplies the enforcement rule when ingredients do not match.
Jumping straight to reject will make legitimate business emails vanish
This is the single most common pitfall encountered in client projects, warranting upfront caution.
"If we want to stop spoofing immediately, why not set DMARC straight to reject?" While understandable, doing so from the outset almost guarantees operational disruptions. Most small and mid-sized businesses do not send emails exclusively from primary corporate servers. External platforms routinely send email bearing the corporate domain: billing software delivering invoices, booking systems dispatching automated reminders, email marketing platforms broadcasting announcements, or external web contact forms.
Configuring DMARC to reject before registering these external systems in SPF and DKIM causes receiving servers to reject failing messages outright. Invoices vanish before reaching clients, and appointment confirmations fail to send—disrupting business-critical communications. Halting spoofing at the expense of legitimate business operations defeats the purpose.
The correct progression begins with none. Under none, message delivery is unmodified, operating in an observational mode that gathers authentication results via aggregate reports. This provides clear visibility into which services send mail using your domain and at what volume. From there, register each legitimate sender in your SPF and DKIM records to ensure verification passes. Once zero unauthenticated senders remain, escalate policy enforcement to quarantine, and ultimately to reject. Solidifying domain security requires auditing authorized traffic before locking the gates.
What to configure as a Google Workspace administrator
Actual configuration spans two distinct dashboards: the Google Workspace Admin Console and your DNS management provider. Clarifying this division prevents common configuration mistakes.
Enabling DKIM occurs within the Google Workspace Admin Console, where administrators generate a domain DKIM key and publish the resulting TXT record to DNS to activate authentication. SPF and DMARC configurations are handled primarily on the DNS provider side. Because both require updating DNS records, having registrar credentials and admin access on hand directly impacts project velocity. In SMB implementations, locating who holds domain administrative access is often the most time-consuming bottleneck.
Once configured, validating operation is vital. Google Postmaster Tools tracks domain authentication success rates and user-reported spam metrics over time. Cross-referencing these metrics with DMARC aggregate reports pinpoints precisely which sending services fail authentication, providing the data needed to evaluate whether advancing to reject is safe. Email authentication is an ongoing operational workflow that requires monitoring reports and advancing policies gradually. To audit broader communication security, reviewing the Google Workspace Security Checklist helps identify peripheral gaps such as external sharing rules and multi-factor authentication enforcement.
Protecting internal employees from sophisticated inbound phishing attacks represents a distinct challenge from outbound domain authentication. Inbound defenses against AI-generated phishing are detailed in AI Phishing Defense and Email Authentication. Ensuring outbound deliverability while filtering inbound deception represents a dual-track strategy necessary for true corporate email security.
Case study: phased rollout for a trading firm caught in a send-and-suspend cycle
Consider a practical engagement. A 30-person trading firm (name withheld) reached out: "Our marketing newsletters are landing in spam folders or failing to deliver altogether, while customers have reported receiving suspicious phishing emails spoofing our company."
An audit revealed a clear diagnosis. In addition to standard Google Workspace correspondence, the firm used external services for invoicing and marketing broadcasts. However, only the marketing service was included in their SPF record, leaving the invoicing tool unregistered. DKIM was only partially activated, and DMARC had never been configured. Their authentication foundation was riddled with gaps.
Rather than enforcing strict policies prematurely, we initiated an observational phase. We published a DMARC policy with none, monitoring passing and failing senders for two weeks via Postmaster Tools and DMARC aggregate reports. The audit confirmed that the billing tool and a legacy contact form failed authentication. We updated SPF records and configured DKIM signatures for each service. Once verified, we graduated DMARC to quarantine, confirmed zero operational disruptions over several weeks, and finally promoted the policy to reject.
Consequently, newsletter delivery stabilized, and spoofing inquiries ceased entirely. Success was not driven by brute-force policy enforcement, but by cataloging all legitimate sending sources before closing the gates. Following the proper sequence secured domain defenses without disrupting a single business-critical email.
First step: inventory who sends mail from your custom domain
Before touching DNS settings, perform one foundational audit: inventory every service authorized to send email using your company's domain. Internal corporate mail, accounting packages, booking systems, marketing platforms, and website contact forms—listing these reveals what would be blocked if DMARC were escalated straight to reject.
With this inventory established, authentication proceeds smoothly and safely. Rushing DMARC enforcement without inventorying senders risks self-inflicted delivery outages. Because deliverability and anti-spoofing rely on the same authentication protocols, proper configuration elevates inbox placement and security simultaneously. Executed methodically, email authentication is one of the most cost-effective security safeguards available to SMBs.
If your company faces spam classification issues, receives customer complaints regarding domain spoofing, or lacks visibility into authorized custom domain senders, schedule a consultation through GleamHub's Free IT and Google Workspace Advisory. From sender inventory audits to phased SPF/DKIM/DMARC rollouts and Postmaster Tools validation, we partner with your team to fortify domain deliverability without interrupting daily operations. For optimizing daily email workflows, explore our article on Leveraging Gmail for Business, or read Understanding Google Workspace for a comprehensive platform overview.
Sources
- Email Sender Guidelines - Gmail Help
- Set up DMARC | Security & data protection | Google Workspace Help
- How to Configure DMARC for Gmail | Risks of Non-Implementation and Common FAQs
- One Year After Gmail Sender Guidelines Revisions: Transitioning DMARC from Implementation to Operations - Baremail Blog
- [2026 Edition] Comprehensive Guide to Gmail Sender Guidelines from A to Z - blastengine
