Why isn't a working Gmail inbox the complete answer?
Your inbox shows that one account can send and receive in the situations you have observed. It does not inventory the services using the business domain. A booking tool, newsletter platform, or invoice application may send by a different route and need its own supported configuration.
Before asking for technical changes, write down the messages your business sends regularly. Include customer confirmations and automated notifications as well as employee conversations. We recommend asking the person who uses each tool to identify it. That produces a more useful starting point than a screenshot of the Gmail settings page.
What are the separate setup and verification steps?
Google's DKIM instructions distinguish generating the key, publishing its public DNS value, and turning on and verifying signing. The task is not finished simply because a record was saved. Ask your administrator to confirm the sending state and inspect an ordinary test message from the domain.
Google also documents cases where a domain provider has performed part of the setup automatically. Rather than repeating those steps blindly, have the administrator inspect what already exists. Replacing a working configuration without understanding it can create extra work and erase useful evidence of the earlier state.
What if another service sends using our address?
Google's DMARC setup guidance explicitly includes third-party email. Ask whether each service can authenticate using the domain that clients see and whether a representative message passes the necessary alignment check. A vendor saying it supports email authentication is a capability statement; your account still needs the appropriate setup.
Keep a service-by-service record of the result. If one tool cannot be configured as expected, ask for the limitation and available options in writing. Do not treat a failed test as permission to weaken the entire domain's policy or to bypass authentication checks for broad categories of messages.
How do we avoid changing too much at once?
We recommend agreeing the smallest change that addresses the observed issue, preserving the previous values, and checking the affected sender before moving on. This makes it easier to understand cause and effect. A provider migration, an added marketing tool, and a stricter DMARC policy should not be treated as one unexplained switch.
Ask for an owner on both sides: the person authorized to change DNS and the person who can verify the business workflow. Use test content rather than client records. Record what was tested, where it was received, and whether any forwarding or gateway was involved.
- Confirm the exact business domain and its DNS administrator.
- List Gmail and every additional sending service.
- Verify signing and alignment with representative messages.
- Agree how new tools will be reviewed before they send to clients.
What is a useful outcome for the owner?
You should be able to explain which services send under your name and where the evidence lives. The outcome is a clearer, maintained setup with documented limits. It is not a claim that every authenticated email deserves trust or that the Workspace subscription has covered every security responsibility.