Connecting Google Workspace

Module 7: Connecting external services · Reading time: 8 minutes

Learning objective: After this lesson, you can set up the DNS records for Google Workspace and check that they're correct.

Key terms: verification TXT (google-site-verification=), MX smtp.google.com, old ASPMX set, SPF include:_spf.google.com, DKIM TXT google._domainkey, Google Admin console

What Google needs from your DNS

Google Workspace (Gmail, Calendar and Drive with your own domain) works broadly the same as Microsoft 365 from lesson 7.1. You set up four things in the DNS:

1. verification: proving that the domain is yours;
2. MX: getting mail delivered to Google;
3. SPF: giving Google permission to send mail on behalf of your domain;
4. DKIM: a signature under your mail.

After that comes DMARC (lesson 4.5). An autodiscover record like the one for Microsoft isn't needed for Gmail.

Here too: copy the values from the Google Admin console for your domain. Google occasionally updates the instructions. The examples below were correct at the time of writing.

Step 1: verification with a TXT record

When you add your domain, Google gives you a code. You set this as a TXT record on the bare domain:

example.com.   3600   IN   TXT   "google-site-verification=AbCdEf123456..."

Google Search Console uses the same kind of record. If you already have a code there, the new one can simply sit alongside it. Multiple TXT records on @ are allowed; only SPF may appear just once (lesson 4.2).

Google can also give a CNAME record for verification, with a name that looks like a long code. Choose whichever is easiest in your panel. Both work.

Step 2: the MX to Google

Since 2023, Google has issued a single MX record for new domains:

example.com.   3600   IN   MX   1 smtp.google.com.

Do you come across a set of five records in older guides or for existing domains? That still works:

example.com.   3600   IN   MX   1  aspmx.l.google.com.
example.com.   3600   IN   MX   5  alt1.aspmx.l.google.com.
example.com.   3600   IN   MX   5  alt2.aspmx.l.google.com.
example.com.   3600   IN   MX   10 alt3.aspmx.l.google.com.
example.com.   3600   IN   MX   10 alt4.aspmx.l.google.com.

You don't need to convert a working old set. Do choose one of the two methods, and don't mix them with MX records from your previous provider.

Just as with Microsoft:

• Remove the old MX records. If you leave them in place, some senders will still try them, for example if Google doesn't respond for a moment. That mail then arrives at the old location.
• Turn off local delivery at your web host. If your website runs with a hosting provider that also offers mail, that server may still deliver mail from your own forms locally. In DirectAdmin, that's the checkbox "Use this server to handle my e-mail".

The number before the mail server (1) is the priority. With a single MX record, the number doesn't matter; just copy what Google provides (lesson 4.1).

Step 3: adding to SPF

Google wants to be included in your SPF record with:

include:_spf.google.com

Note the underscore before spf. Add this to your existing SPF record instead of creating a second one:

example.com.   3600   IN   TXT   "v=spf1 a mx include:spf.hosting.example include:_spf.google.com ~all"

If you no longer use your web host for mail, you can remove include:spf.hosting.example. If you're unsure, leave it in: a contact form on your website often sends mail via the web server.

Step 4: DKIM with a TXT record

With Google, DKIM is a TXT record with a public key, not a CNAME like with Microsoft. You first generate the key in the Admin console (under the Gmail settings, in the section for verifying e-mail). Google then gives you:

google._domainkey.example.com.   3600   IN   TXT   "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

• The name is google._domainkey. google is the selector (lesson 4.4). You can choose a different selector in the Admin console; the name then changes to match.
• The value is long. In the Admin console, preferably choose a 2048-bit key. Some panels can't store a TXT value longer than 255 characters; in that case choose 1024 bits, or use a panel that splits long values into parts automatically.
• Paste the value in one go, without extra spaces or line breaks.

Once the record is live, click the button in the Admin console to start signing. Only then does Google sign your mail. If a test mail in Gmail shows PASS with d=example.com under "Show original" for DKIM, it has worked.

DKIM records from different services don't interfere with each other, because each selector has its own name. A key from your web host (for example x._domainkey) can stay in place alongside google._domainkey.

Step 5: DMARC

Gmail is one of the parties that, since 2024, expects a DMARC record from high-volume senders. If you don't yet have a DMARC record, start with p=none and a reporting address, and tighten it up later (lesson 4.5):

_dmarc.example.com.   3600   IN   TXT   "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

In practice: what it looks like in a panel

In the example panel My WebOké, you choose Google Workspace under Quick setup on the DNS tab. You'll see the MX and the SPF addition beforehand, and local delivery is turned off. You get the verification code and the DKIM key from Google; you add those yourself as a TXT record. In DirectAdmin, you choose the Google Workspace template under MX Records and switch off the checkbox for delivery.

In other panels, such as cPanel, Plesk, Cloudflare or your registrar's DNS screen, the buttons have different names, but you fill in the same fields: name, type, value and TTL. Some registrars have a ready-made template for Google.

Summary

• Copy the values from the Google Admin console.
• Verification: TXT google-site-verification=... on @ (or the CNAME that Google offers).
• MX: 1 smtp.google.com.; the old set of five ASPMX records also works. Remove MX records from your previous provider.
• SPF: add include:_spf.google.com to the existing record.
• DKIM: TXT on google._domainkey, then turn on signing in the Admin console.

Quiz

Exercise

Exercise Z7.2: Recognising Google Workspace. Compare the old and new way of setting up Google mail.

1. Look up the MX record for google.com. Write down the name of the mail server.
2. Look up the MX records for shopify.com. This company uses Google mail with the older set. How many MX records do you see, and which name has the lowest priority (the lowest number)?
3. Look up the SPF record for google.com and write down the include.

Fill in your answers. The check looks up the records live when you submit.

Exercise O7.2: Setting it up yourself in your practice zone. Connect your practice zone <code>.dnspractice.eu to a simulated Google Workspace. In the practice zone, you use the fake service mailsuite-demo.dnspractice.eu; for your real domain, copy the values from the Google Admin console.

1. Verification: set a TXT record on <code>.dnspractice.eu with the code given on the exercise page (google-site-verification=oefen-<code>-<...>).
2. MX: have <code>.dnspractice.eu receive mail at smtp.mailsuite-demo.dnspractice.eu. with priority 1. No other MX may remain on <code>.dnspractice.eu, including one from a previous exercise.
3. SPF: make sure the SPF record on <code>.dnspractice.eu contains include:_spf.mailsuite-demo.dnspractice.eu. There may only be one SPF record.

Further reading

These pages describe the steps in WebOké's panels (DirectAdmin and My WebOké). Other panels work the same way.

• DirectAdmin guide 5.10: E-mail with Microsoft 365 or Google Workspace, website with WebOké
• WebOké manual 5.6: Set up email quickly in the DNS
• Your email elsewhere: Microsoft 365, Google Workspace, or your own mail server
• DirectAdmin guide 5.8: Turning on and checking DKIM
• DirectAdmin guide 5.5: MX records: where does your email arrive?