Complete Corporate Email Setup on Google Workspace
A corporate email address acts as your digital front desk. A Google Workspace email setup succeeds when five DNS records and one admin account work together. One wrong value sends messages into a void. This guide works as a DNS reference. Y...
A corporate email address acts as your digital front desk. A Google Workspace email setup succeeds when five DNS records and one admin account work together. One wrong value sends messages into a void.
This guide works as a DNS reference. You get each record, its host, its value, and its wait time, all taken from Google help pages. Verify each value on the linked official page before you save, because Google updates record values and admin screens.
Prepare before you change DNS
Collect four items first. Missing one causes most delays.
- An active domain and login access to the registrar.
- The DNS host. If the registrar and DNS host differ, edit records at the DNS host.
- A Google Workspace plan. Check current prices on the Google Workspace pricing page, because prices vary by region and billing term.
- A user list with the mailboxes, aliases, and groups you need.
Record the current MX records before you replace them. If the domain receives mail through another provider, back up the mail first. Lower the DNS TTL beforehand if your host allows the change, so edits spread sooner.
Step 1: create the admin account
Sign up through the official flow and create the first admin account. This account becomes the super admin. Use a strong, unique password and turn on 2-Step Verification right away. Keep the super admin for administration only and use a separate account for daily mail.
Step 2: verify the domain
Google lists three verification routes. You can update DNS at the registrar, add a TXT record, or use the Google Workspace setup tool, which supplies a code to enter at the registrar. Google prefers DNS records because they confirm ownership best. HTML strings and meta tags are not recommended, because attackers can misuse them to create fraudulent accounts.
Timing rules matter. Verify within 9 days of the trial start or paid contract. Otherwise the account is deleted automatically within 21 days of signup unless billing is active. Adding the record takes about 10 minutes. After the record is live, confirmation can take up to one hour. See Google guide Verify your domain for Google Workspace.
If verification fails, check three points. Confirm the record sits in the active DNS zone. Confirm the host field and full TXT value match the Admin console. Confirm the record saved.
Step 3: route mail with MX records
MX records tell the internet where to deliver mail. Google documents the current setup in Set up MX records for Google Workspace.
| Setting | Value stated by Google |
|---|---|
| MX value | smtp.google.com |
| Priority | 1 |
| TTL | Registrar default, or 1 |
| Propagation | Up to 72 hours for recognition |
Older guides list five aspmx servers with priorities from 1 to 10. Google states accounts started before 2023 may use aspmx values and the legacy values remain supported. Choose one style. Never publish both sets together, and delete every old provider record. A mixed set splits mail between systems and causes hard-to-trace losses.
After the records go live, activate Gmail for the domain in the Admin console under Apps, Google Workspace, Gmail, if the console shows Gmail as off.
Step 4: publish the SPF record
SPF names the servers allowed to send mail for your domain. Google documents this value in Set up SPF:
| Field | Value |
|---|---|
| Type | TXT |
| Host | @ for the root domain |
| Value | v=spf1 include:_spf.google.com ~all |
| Wait | Up to 48 hours before SPF authentication works |
Some DNS hosts require quotation marks around the value. Check your host documentation. Give each subdomain and each separate domain its own SPF record. A single record can hold up to 10 include tags according to Google.
If another service also sends mail for the domain, merge its include into the same record. Publishing two separate SPF records for one name breaks SPF checks.
Step 5: turn on DKIM
DKIM signs outgoing mail so receivers can verify the sender. The Google DKIM guide lists these steps.
- Open Apps, Google Workspace, Gmail, then Authenticate email in the Admin console. A super admin must do this.
- Select the domain and click Generate New Record. Choose a 2048-bit key when your DNS provider supports the length. Use 1024-bit otherwise.
- Copy the TXT record name and value. Do not click Start authentication yet.
- At your DNS host, create the TXT record. The host is the name Google shows, such as google._domainkey, and the value starts with v=DKIM1.
- Return to the Admin console and click Start authentication.
- Send a test message to a Gmail or Workspace address. Open the message header and look for a DKIM pass in the Authentication-Results line.
Wait 24 to 72 hours after you turn on Gmail before you generate the key. An early attempt can produce a DKIM record was not created error. After you add the key, authentication can take up to 48 hours to start. Mail sent to yourself does not verify DKIM.
Step 6: add DMARC
DMARC tells receiving servers what to do with mail failing SPF and DKIM checks. Google documents the steps in Set up DMARC.
| Field | Guidance from Google |
|---|---|
| Type | TXT |
| Host | _dmarc.yourdomain.com. Some hosts append the domain automatically, so check the saved record. |
| Required tags | v and p must come first |
| Report address | rua tag with a mailto address |
| Timing | Wait 48 hours after SPF or DKIM before DMARC |
The p tag sets the policy. Google describes three options.
| Policy | Result |
|---|---|
| none | Mail is delivered and logged in a daily report sent to the rua address |
| quarantine | Mail goes to the recipient spam folder |
| reject | The receiving server refuses the mail, usually with a bounce |
Start with p set to none while you review reports. Then tighten the policy over time. Use the pct tag to apply a policy to a small share of messages first, and raise the share to 100. The official page shows a full example record. Copy its structure and replace the sample addresses with your own.
Google requires authentication for some senders. All senders must set up SPF or DKIM. Bulk senders, defined as more than 5,000 messages per day, must set up SPF, DKIM, and DMARC.
Step 7: create users and test
Add users in the Admin console under Directory, Users. Use aliases or groups for shared addresses such as sales and info instead of buying extra mailboxes. Enroll every user in 2-Step Verification.
Then run three live tests:
- Send mail from the new account to an external inbox.
- Reply from the external inbox to the new address.
- Open the received message header and confirm SPF, DKIM, and DMARC all pass.
Post-launch checklist
Finish the project with a short review. Each item takes minutes and prevents later surprises.
- Save a copy of every DNS record in a shared document, with the date of each change.
- Read the first DMARC reports and confirm every legitimate sender passes before you tighten the policy.
- Test connected tools, such as website forms, billing systems, and CRMs, so each sends from an authenticated address.
- Set a calendar reminder to review the DNS records and admin roles every quarter.
- Train staff to report suspicious messages to an admin right away.
DNS records cheat sheet
| Record | Type | Host | Value source | Wait |
|---|---|---|---|---|
| Domain verification | TXT | Shown in Admin console | Admin console code | Up to 1 hour to confirm |
| MX | MX | @ | smtp.google.com, priority 1 | Up to 72 hours |
| SPF | TXT | @ | v=spf1 include:_spf.google.com ~all | Up to 48 hours |
| DKIM | TXT | Name shown in Admin console | Generated key starting v=DKIM1 | Up to 48 hours |
| DMARC | TXT | _dmarc | Policy tags with rua address | Start 48 hours after SPF or DKIM |
Common failures and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| Verification fails | Record in the wrong DNS zone or wrong host | Edit the active DNS host and compare the value character by character |
| Mail does not arrive | Old MX records remain or Gmail is off | Remove old records and activate Gmail |
| Mail lands in spam | SPF, DKIM, or DMARC missing | Publish all three and retest |
| SPF fails | Two SPF records for one name | Merge into a single record |
| DKIM will not start | Key generated too early | Wait up to 72 hours after enabling Gmail, then regenerate |
Propagation delays are normal. Verify the saved records, wait, then test again from outside the domain. When problems persist, compare every DNS line with the official Google page. One missing dot, quote, or character often causes the failure.
FAQ
What is the current Google Workspace MX record?
Google documents smtp.google.com with priority 1. Older aspmx values remain supported for accounts started before 2023.
How long does DNS take to update?
Google states MX records can take up to 72 hours to be recognized. SPF and DKIM can take up to 48 hours.
Can I publish two SPF records?
No. Merge all sending services into one SPF record per name.
Should DMARC start at reject?
No. Google recommends starting with p set to none, reviewing reports, and tightening over time.
How much does Google Workspace cost?
Check the official pricing page. Prices vary by region and billing term, and Google updates them.
Conclusion
A clean Google Workspace email setup follows a fixed order: verify the domain, publish MX, add SPF, enable DKIM, add DMARC, then test from outside addresses. Copy every value from the official Google pages, remove old records, and allow DNS time to refresh. Spend the extra hour on testing before you announce the new addresses.
