Skip to content

Plan: Email strategy + consolidation (Justin + Michael), 2026-06-08

Long-term (5-year) email architecture for Justin and his brother Michael across personal channel accounts and the shared/solo businesses. Companion to subscription-consolidation-2026-06-08. Supersedes the email-consolidation portions of google-oauth-permanent-fix-2026-05-04 Step 5.

Decided architecture

Principles: channel accounts = identity anchors (never migrate); business email must send authenticated (deliverability); business email owned at business level; one Workspace holds every domain (bill per person, not per domain).

Justin (2 logins, hard personal/business wall)

Michael (one daily inbox via forward-a-copy)

Shared

  • [email protected] — Google Group (collaborative inbox). Members: Justin + Michael. Send-as enabled for the occasional outbound. No shared password, full audit. Used for Shopify/marketing logins + light comms.

Workspace structure: Option A (one combined Workspace)

  • Org primary domain: justinwieb.com. Secondary domains folded in: gusthebass.com, gusoutdoor.co (+ shopnovadesign.com / sipnservesociety.com per decisions below).
  • 2 human seats: Justin ([email protected]) + Michael ([email protected]). Everything else = free aliases + the Group.
  • Justin is admin. Splittable to Option B later (domains can be moved to a dedicated shared-Gus Workspace) if the partnership formalizes.

Deliverability

  • SPF, DKIM, DMARC configured in Cloudflare DNS (Justin's, API-accessible) for every sending domain so nothing spam-folders. Bulk marketing continues through the ESP (Mailchimp today, Listmonk later), not Gmail send-as.

DNS audit + fixes, 2026-06-08

Audit found SPF on the four _spfm-managed domains was broken: SPF referenced dc-aa8e722993._spfm.<domain>, a subdomain that does not exist (PermError) -> Google was never actually authorized. gusthebass.com had no SPF at all. No domain publishes Google DKIM except sipnserve. No domain enforces DMARC (p=none or missing).

Done (Cloudflare, safe + migration-durable, strictly improving): - gusthebass.com: SPF added v=spf1 include:_spf.google.com ~all. - justinwieb.com: SPF fixed (broken ghost include -> Google include). - gusoutdoor.co: SPF fixed (broken ghost include -> Google include).

Held (fix with their sender context, both being offloaded): - shopnovadesign.com (Nova, may send via Shopify) and sipnservesociety.com (Krystal, sends via Mailchimp): SPF still broken; replace with Google + the right ESP include when handled.

Pending (needs Workspace admin -> Justin, best done on FINAL consolidated Workspace): - DKIM: generate per-domain keys in admin.google.com (Apps -> Gmail -> Authenticate email), Claude publishes the google._domainkey TXT via Cloudflare. - DMARC: after DKIM live, ratchet none -> quarantine -> reject with a reporting address.

Cost

~$14-18/mo (2 Workspace seats) vs ~$70/mo today across the separate per-domain subscriptions. Personal/channel Gmails stay free.

Migration steps (safe order, mostly Justin in admin.google.com with Claude guiding)

A domain can live on only ONE Workspace account at a time. For each domain folded into the justinwieb.com Workspace, migrate its mail BEFORE removing it from its old account, then cancel the old subscription.

  1. Inventory: log into each existing Workspace admin (gusoutdoor.co, gusthebass.com, justinwieb.com, shopnova, sipnserve); record seats + mailboxes. (Claude can't see Workspace billing/admin; Justin pulls this.)
  2. Decide keepers: shopnovadesign.com (Nova winding down) keep-as-alias or drop; sipnservesociety.com hand to Krystal or drop.
  3. For each domain to fold (gusthebass.com, gusoutdoor.co, +keepers): a. Migrate mail out of the old mailboxes via Google Data Migration into the destination user/group. b. Remove the domain from its old Workspace account. c. Add it as a secondary domain on the justinwieb.com Workspace (verify via Cloudflare DNS TXT, Claude can add the record). d. Recreate addresses: [email protected] (seat), justin@/michael@ aliases, [email protected] (Group). e. Cancel the old Workspace subscription once validated.
  4. Michael seat + aliases: create [email protected], add [email protected] alias, set gusthebass as default From.
  5. Justin aliases: add [email protected], [email protected] to [email protected]; verify send-as.
  6. [email protected] Group: create, add both, enable "members can send as group," test send + receive.
  7. Channel forward-a-copy: in each of Michael's 3 channel Gmails, Settings -> Forwarding -> forward to [email protected] with "keep Gmail's copy in the Inbox"; add filters on the receiving side to label by source.
  8. Delegation: grant Justin delegate access to [email protected] inbox.
  9. DNS: set/verify SPF + DKIM + DMARC in Cloudflare for justinwieb.com, gusthebass.com, gusoutdoor.co (+ keepers).
  10. Validate every inbox sends + receives correctly, then cancel redundant Workspace subs.

What Claude can vs can't do

  • Can (via Cloudflare API): all DNS records (domain verification TXT, SPF, DKIM, DMARC).
  • Cannot directly: Workspace user/alias/group admin + mailbox migration live in admin.google.com (separate console, no API access here). Justin executes with Claude's step-by-step. (A service account with domain-wide delegation could automate some Workspace Admin SDK ops later, but not needed for this one-time setup.)

Open items

  • Michael confirms the forward-a-copy / one-inbox setup (Justin is speaking for it; Michael should sign off since it touches his channel accounts).
  • Nova (shopnovadesign.com) keep-as-alias vs drop.
  • sipnserve (sipnservesociety.com) -> Krystal vs drop (ties to Mailchimp/Listmonk migration).
  • 2FA on [email protected] confirmed (needed if any app-password/SMTP step arises).

AI integration (after consolidation)

With business mail funneled to 2 Workspace inboxes + the Group, forge AI triage wires in cleanly: daily digests per brother ("3 sponsor emails, 1 Shopify issue, 1 copyright notice"), business send-with-confirm, personal Gmail read/draft-only never-send (per CLAUDE.md security rules). Michael's one-inbox makes his digest trivial.

[Claude Code, 2026-06-08]