[ Platform guides ]

Google Workspace aliases and secondary domains: verify SPF and DKIM alignment

Check authentication separately for every Workspace alias and secondary-domain From identity.

By the EmailAuth research team · 4 min read

[ Key points ]

  • Protect each brand’s sending identity
  • Build a domain and route matrix
  • Separate authorization from alignment
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Check authentication separately for every Workspace alias and secondary-domain From identity.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Build a domain and route matrix

The received identity is the verification target.

Next steps

  1. Inspect send-as SMTP settings.
  2. Test primary, alias, secondary-domain and reply paths.
  3. Record strict versus relaxed alignment assumptions.

CISO / SecOps

Separate authorization from alignment

An approved user action is not authentication evidence.

Next steps

  1. Review who can send as each identity.
  2. Retain exact alignment assumptions with headers.
  3. Review external send-as relays when users change roles.

Founder / Non-technical

Protect each brand’s sending identity

Shared administration does not remove domain-specific work.

Next steps

  1. List every customer-facing From domain.
  2. Require a test before switching a brand live.
  3. Include every brand domain in the launch checklist.

[ FAQs ]

Frequently asked questions

Does the same mailbox mean the same DMARC domain?

No. Evaluate the domain in the message’s visible From address.

Add a user alias domain or secondary domain RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Does an alias always use Google’s sending infrastructure?

No. Send-as configuration can specify an external SMTP service; inspect the actual route.

REST Resource: users.settings.sendAs  |  Gmail  |  Google for Developers

Can different company-owned domains align relaxed?

Ownership alone is insufficient. Different organizational domains do not align merely because one company owns them.

RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Should I reuse the primary domain’s DKIM TXT value?

Use the configuration generated for the selected sending domain rather than copying another domain’s key.

Set up DKIM

Does an MX record establish SPF?

No. Incoming routing and outbound SPF authorization are separate functions.

RFC 7208: Sender Policy Framework

Why test replies?

A reply may use a different From identity or send-as route from a new message.

Can a second signature change the answer?

Yes. One valid aligned DKIM signature can provide the DMARC passing path.

RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

What changes require retesting?

Domain changes, alias settings, external relay changes, DNS migration and key rotation.

[ Sources ]

Sources

  1. Add a user alias domain or secondary domain

    Sections User alias domains and secondary domains

  2. Set up DKIM

    Sections Generate a DKIM key · Add the DKIM key · Turn on and verify DKIM

  3. REST Resource: users.settings.sendAs  |  Gmail  |  Google for Developers

    Sections Provider procedure and operational considerations

  4. RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

    Sections Identifier alignment · Policy and receiver handling

  5. RFC 7208: Sender Policy Framework

    Sections MAIL FROM identity · DNS lookup limits

[ Glossary ]

Glossary

Alias domain
An additional domain that supplies alternate addresses for existing users.
Secondary domain
An additional domain used for a separate set of users within the account.
Strict alignment
An alignment mode requiring exact domain equality.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base