How do I set up Gmail Postmaster Tools for a domain with subdomains?
Published 23 May 2025
Updated 18 Oct 2026
13 min read
Summarize with
Updated on 18 Oct 2026: We clarified subdomain verification, Gmail reporting limits, and how bulk sender thresholds apply across subdomains.
If your website is on a parent domain but your email sends through a subdomain, add the domain used to authenticate outgoing mail. Google accepts either the domain in your DKIM d= value or the SPF Return-Path domain. If both use the same domain, one entry covers messages authenticated by SPF, DKIM, or both. If they differ, add each authenticated domain you control whose data you need to monitor. Individual dashboards have different authentication requirements.
Verify the parent domain first when you control its DNS, then add each active sending subdomain that appears in authentication. Google says subdomains can be added the same way as a primary domain and recommends adding them after the primary domain. Once the primary domain is verified, you do not need to verify its subdomains again. The Google setup guide gives that rule directly.
Fast answer
Verify the parent domain first when you control its DNS. Then add every active subdomain used in DKIM d= or SPF Return-Path that needs its own dashboard. Parent verification removes the extra DNS verification step, but you still add a subdomain to see its data independently.
Which domain to add
Gmail Postmaster Tools is not asking for your marketing website domain just because that is the domain people know. It asks for a domain used to authenticate outgoing mail. For a subdomain sender, that often means the subdomain, but the final choice depends on the SPF and DKIM identities in a real message.
- If DKIM signs with the subdomain: verify the parent first when possible, then add the DKIM signing subdomain for its own dashboard.
- If DKIM signs with the parent: add the parent domain, then add a subdomain only when it has its own authenticated traffic to monitor.
- If SPF uses a subdomain Return-Path: add the Return-Path domain you control for applicable SPF-authenticated data. The Spam rate dashboard requires DKIM-authenticated mail.
- If you use several subdomains: verify the parent first, then add each subdomain that sends enough real Gmail volume to produce useful data.
Adding only the subdomain
- Best use: you only control DNS for the subdomain and cannot verify the parent domain.
- Main benefit: the dashboard maps closely to the actual Gmail sending identity.
- Main limit: you lose the simpler ownership path that comes with parent-domain verification.
- Trade-off: this works for constrained access but creates more DNS work as new subdomains are added.
Verifying the parent first
- Best use: you control parent DNS and have multiple sending subdomains to monitor.
- Main benefit: subdomains can be added without a separate verification step after the parent is verified.
- Main limit: dashboards still require enough Gmail volume before data appears.
- Recommended use: choose this setup when the same organization owns the parent domain and its sending subdomains.
Gmail Postmaster Tools follows authenticated sending domains, not the visible brand site alone. A website at example.com and a sender at m.example.com are related, but Gmail still assigns dashboard data according to the authentication domains on the message.
Check DKIM and SPF before adding a domain
Before adding anything, send a real message to a personal Gmail address. In Gmail, open the message's More menu and select Show original. Find the DKIM d= domain and the SPF Return-Path domain, then confirm their pass results in Authentication-Results. If both point to the same parent or subdomain, the choice is straightforward. If they differ, verify the parent first when possible, then add each authenticated domain you control whose stream you need to monitor.
|
|
|
|
|---|---|---|---|
DKIM d= parent | Parent | Subdomains with their own authentication identity | Parent carries the DKIM identity |
DKIM d= subdomain | Parent | DKIM subdomain | Subdomain can have a separate view |
SPF subdomain | Parent | Return-Path | SPF supplies applicable data, but spam rates require DKIM |
Many senders | Parent | Each authenticated sending domain you control | Simpler ownership and separate views |
Verify the parent first when you control its DNS; otherwise, verify the authenticated subdomain directly.
If your provider signs DKIM or uses a Return-Path only on its own domain, you cannot verify that domain through your DNS. Ask the provider to configure custom DKIM signing with your domain, then check another real message. You can also run a broader domain health checker review before you start, because broken SPF or DKIM will make Postmaster Tools data harder to interpret.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
This check is useful before adding subdomains because a subdomain sender often has different SPF, DKIM, DMARC, bounce handling, and DNS ownership from the parent domain. Postmaster Tools will not fix those records. It reports what Gmail observes after the domain is verified and enough mail flows to personal Gmail accounts.
In the legacy Domain Reputation dashboard, Google uses the exact authentication domain: DKIM when available, or SPF when the sender does not use DKIM. That makes the DKIM d= domain a useful first clue. This fallback rule does not apply to every dashboard: Spam rate requires DKIM-authenticated messages. See Google's dashboard documentation for each view's requirements.
DKIM signing domain and SPF Return-Path used to choose a Gmail Postmaster Tools domain
Setup steps for parent domains and subdomains
Google Postmaster Tools screen for adding a parent domain and subdomain
Use this sequence when you control the parent DNS. It avoids repeat verification work and keeps domain ownership manageable. If you only control the sending subdomain, add and verify that subdomain directly instead.
- Add the parent domain: sign in to Postmaster Tools with a Google Account. On Manage Domains, select Add new domain, enter the registered domain, such as example.com, and click Create.
- Publish the verification record: beside the domain, open More options, then Verify domain. Copy the TXT or CNAME record Google supplies and publish that record in DNS.
- Complete verification: return to Verify ownership of domain and click Verify. The status usually updates immediately but can take up to 10 minutes after Google can find the DNS record.
- Add the sending subdomain: enter the authenticated subdomain, such as m.example.com or mail.example.com. Skip separate DNS verification when the verified parent covers it.
- Check the dashboard after sending: select the verified domain and a dashboard after real traffic reaches personal Gmail mailboxes. Allow for reporting delays and low-volume data suppression.
Example parent-domain TXT verification recordDNS
Host: example.com Type: TXT Value: google-site-verification=PASTE_GOOGLE_VALUE_HERE
Example direct subdomain TXT verification recordDNS
Host: m.example.com Type: TXT Value: google-site-verification=PASTE_GOOGLE_VALUE_HERE
Only use the second example when you are verifying the subdomain directly. If the parent domain is already verified in Postmaster Tools, add the subdomain from the interface without another DNS verification record. Always publish the exact verification record shown for your account. These examples show TXT verification; use a CNAME instead only when Google supplies that option. Add a separate verification record without replacing existing SPF, DKIM, or DMARC records.
Do not guess the DNS name
DNS providers display hostnames differently. Some expect the full hostname, while others append the zone automatically. Paste the value Google gives you, then confirm how your DNS provider expands the host field before pressing verify.
For a separate walkthrough of the ownership step, use the verification guide. For this setup, the important sequence is to verify the parent first when you can, then add authenticated subdomains.
Give other people access
A verified owner can give teammates or clients access without asking each person to repeat domain verification. The person must use a Google Account or Google Workspace account, and access can only be granted for a verified domain.
- Open Manage Domains: find the verified parent domain or subdomain.
- Open user management: select More options, then Manage users beside the domain.
- Add the account: select New user, enter the email address tied to the person's Google Account, then click Add.
- Notify the person directly: Google does not send an access notification, so tell them when the domain is ready.
Access and ownership are different
Granting access is the simpler choice for readers who only need dashboards. If multiple accounts must verify themselves as owners, Google requires a separate DNS verification record for each account. Check that each colleague can open every parent-domain or subdomain entry they need.
What to expect after verification
A verified domain does not guarantee immediate charts. Gmail Postmaster Tools reports data only for mail sent to personal accounts ending in @gmail.com or @googlemail.com; messages sent to Google Workspace business addresses are excluded. Google suppresses some low-volume daily data to protect user privacy. Most dashboard data updates within 24 hours, sometimes longer, and reporting dates use UTC.
Troubleshooting a new Postmaster Tools setup
Use these troubleshooting categories to check domain setup and Gmail reporting.
Verified
Good
Ownership is complete, but data still depends on Gmail traffic.
No data yet
Wait
Check Gmail volume, reporting delays, and the selected domain.
Wrong domain
Fix
The added domain does not match the SPF or DKIM identity.
Broken auth
Act
Neither SPF nor DKIM produces the expected authenticated identity.
Check authentication first. If neither SPF nor DKIM passes for the domain you added, use Suped's DKIM checker to confirm the selector and public key, then inspect a real Gmail message's authentication results. Select a dashboard that supports that authentication method.
Compliance rolls up to the primary domain
The Compliance status dashboard reports on the primary domain using traffic from its subdomains, even when you select a subdomain. Other dashboards can show subdomain data independently. Compliance uses a rolling average, so allow up to seven days for a fix to appear. DNS compliance reflects settings observed when messages arrived. See Google's dashboard guidance.
Google encourages senders to use Postmaster Tools v2. The legacy v1 web-interface retirement remains postponed, with no replacement retirement date announced. The legacy Domain and IP Reputation dashboards are scheduled for retirement. Use Compliance status, Spam rate, and Delivery errors for ongoing checks, including Deliverability analysis under Compliance status. Google's deprecation notice confirms the current transition status.
Do not treat Postmaster Tools as your only monitoring source. It is Gmail-specific. A complete review also checks authentication pass rates, DMARC policy progress, DNS record quality, bounce patterns, complaint signals, and blocklist (blacklist) status.
How Gmail counts volume across subdomains
Google counts messages sent under the same primary domain together when determining bulk sender status. Sending close to 5,000 messages or more to personal Gmail accounts within 24 hours qualifies, even when the traffic is split across subdomains. Google's sender guidelines FAQ also states that bulk sender status is permanent once assigned.
For example, 2,500 messages sent by news.example.com plus 2,500 by receipts.example.com to personal Gmail accounts in one day count together as 5,000 for example.com. Separate Postmaster Tools entries do not create separate bulk sender thresholds.
The bulk threshold is separate from dashboard visibility
The 5,000-message figure defines bulk sender status; it is not a published minimum for dashboard data. Lower-volume senders can use Postmaster Tools, although privacy controls suppress some daily results. Review Compliance status for the whole primary domain when adding a new sending subdomain.
Use Suped to investigate authentication issues
Gmail Postmaster Tools provides a mailbox-provider view, but it does not replace DMARC reporting. Suped is our DMARC reporting and email authentication platform. Its DMARC monitoring provides authentication and source-level detail before and after domains are added to Postmaster Tools.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
Suped groups DMARC aggregate data from participating receivers by sending source and domain, tracks SPF and DKIM results, and alerts teams when authentication changes. That workflow helps identify observed sending subdomains before setup and investigate whether a Gmail dashboard issue coincides with a new source, a DMARC failure, or a DNS change.
- Before setup: use Suped's DMARC reports to identify observed sending domains and sources.
- During setup: confirm SPF, DKIM, and DMARC pass rates before judging Gmail dashboards.
- After setup: use alerts and issue steps to catch authentication drift on new subdomain senders.
- For agencies: keep each client's authenticated domains and sending sources separated in a multi-tenant view.
Pair an email tester result with Postmaster Tools when checking a real message path. The mailbox test confirms the exact authentication result, while Postmaster Tools shows Gmail-side reporting after traffic accumulates.
Common setup mistakes
Most setup problems come from adding the wrong domain or assuming verification means data will appear immediately. Use this checklist when a parent-domain and subdomain setup does not behave as expected.
Mistakes to avoid
- Adding the website only: example.com is not enough for a separate subdomain view when Gmail sees m.example.com in DKIM or Return-Path.
- Skipping the parent: direct subdomain verification works, but parent verification avoids separate DNS verification for future subdomains.
- Ignoring authentication: a mismatch between the selected domain and the identity used by that dashboard can leave the expected view empty.
- Expecting instant charts: low Gmail volume and privacy thresholds can leave correctly configured dashboards blank.
Confirm the message headers, add and verify the parent if you control it, then add the authenticated subdomain. If the dashboard stays empty after normal sending, compare Gmail's authentication results with the selected domain and allow for reporting delays. Increasing volume solely to populate a dashboard is unnecessary.
After setup, track the Gmail metrics that match the sending program. The useful set is covered in the guide to Postmaster metrics, but the prerequisite stays the same: add an authentication domain that Gmail sees.
Views from the trenches
Best practices
Verify the parent domain first, then add active subdomains for separate Gmail views.
Use message headers to confirm the DKIM d= domain before choosing what to add first.
Add each subdomain that sends real Gmail volume instead of relying on brand naming.
Document DNS ownership and Postmaster access so future sender changes stay controlled.
Common pitfalls
Teams add the website domain and miss the authenticated subdomain Gmail receives.
Low sending volume gets mistaken for setup failure when dashboards remain empty.
DNS host fields get entered twice because the provider appends the zone automatically.
Subdomains are added before authentication is stable, which makes reports misleading.
Expert tips
Treat the DKIM d= domain as the first clue, then confirm SPF Return-Path as backup.
If parent verification is possible, use it to reduce repeated subdomain DNS work.
Keep Postmaster Tools and DMARC reports side by side for better issue diagnosis.
Review new sender subdomains before launch, not after Gmail reputation starts dropping.
Marketer view
Marketer from Email Geeks says the domain to add should match the domain used in SPF or DKIM, which is often the active sending subdomain.
2021-03-03 - Email Geeks
Marketer view
Marketer from Email Geeks says the DKIM d= value is the key detail because it shows the authenticated domain Gmail evaluates.
2021-03-03 - Email Geeks
