Google provides specific MX records that you need to add. These are standard for all Google Workspace users. You'll typically find instructions in the Google Workspace Admin console during the setup process.
Here are the standard Google Workspace MX records (you'll need to add these exactly as shown, one by one):
Priority | Destination (Value) |
|---|
1 | ASPMX.L.GOOGLE.COM |
5 | ALT1.ASPMX.L.GOOGLE.COM |
5 | ALT2.ASPMX.L.GOOGLE.COM |
10 | ALT3.ASPMX.L.GOOGLE.COM |
10 | ALT4.ASPMX.L.GOOGLE.COM |
Steps to Add MX Records:
Delete Existing MX Records: Before adding Google's MX records, it's crucial to delete any existing MX records for your domain. These might be pointing to your old email provider or a default setting from your registrar. Removing them ensures that all email traffic is directed to Google.
Add New MX Records:
a. In your DNS management interface, look for a section to "Add New Record" or "Add MX Record."
i. Type: Select "MX."
ii. Host/Name/@: Leave this blank or enter ‘@’ (for the root domain).
iii. Priority:** Enter the priority number (1, 5, or 10).
iv. Value/Destination: Enter the Google server address (example - ‘ASPMX.L.GOOGLE.COM’).
v. TTL:** Leave as default.
Repeat this process for all five Google Workspace MX records.
Save Changes: Confirm and save your changes.
MX Record Propagation: Similar to domain verification, MX record changes can take time to propagate. It's common for this to take up to 72 hours, though it's often much quicker. During this propagation period, some emails might still go to your old server (if any), while others go to Google. This is why it's best to configure MX records during off-peak hours if possible.
You can test if your MX records have propagated correctly by sending an email from a different email address, like a personal Gmail to your new Google Workspace email address and checking if it arrives.
Step 4: Create User Accounts
With your domain verified and MX records pointing to Google, you can now create individual user accounts for yourself and your team members.
Access the Google Workspace Admin Console: Go to ‘admin.google.com’ and log in with your administrator account.
Navigate to "Users": From the Admin console homepage, click on "Users."
Add a New User: Click the "Add new user" button (usually a plus sign or "Add user").
Enter User Details:
a. First Name and Last Name:
b. Primary Email: This will be the user's email address (example - ‘[email protected]’).
c. Organizational Unit (Optional): You can assign users to organizational units for easier management and applying specific policies.
d. Generate Password: Google can generate a strong temporary password, or you can set a custom one. It's recommended to let Google generate one and require the user to change it on first login.
Assign Administrator Roles (Optional): If a user needs administrative privileges like to manage other users or settings, you can assign them an administrator role. Be cautious about granting excessive permissions.
Add User: Click "Add New User" to complete the creation.
Repeat this process for every user you need to create. Each user gets their own Google Workspace account, including Gmail, Drive, Calendar, and other services.
BONUS : Enhance Security and Prevent Spam (Optional but Recommended)
To further secure your domain email and improve deliverability, consider implementing these DNS records.
An SPF record specifies which mail servers are authorized to send email on behalf of your domain. This helps prevent spammers from spoofing your domain.
Add a TXT record to your DNS settings:
DKIM adds a digital signature to your outgoing emails, allowing receiving servers to verify that the email truly originated from your domain and hasn't been tampered with.
Generate DKIM Key in Google Workspace:
a. In the Admin console, go to Apps > Google Workspace > Gmail > Authenticate email.
b. Select your domain and click "Generate new record." Google will provide a TXT record.
Add the TXT record to your DNS settings:
a. Type: TXT
b. Host/Name: ‘google._domainkey’ (this part is specific to Google's DKIM setup)
c. Value/Text: Paste the long key generated by Google.
d. TTL: Default
Start Authentication in Google Workspace: Once the DNS record has propagated, return to the Gmail authentication settings in the Admin console and click "Start authentication."
DMARC builds upon SPF and DKIM, telling receiving servers how to handle emails that fail SPF or DKIM checks (e.g., quarantine, reject) and providing reporting to you about these failures.
Add a TXT record to your DNS settings:
Type: TXT
Host/Name: ‘_dmarc’ (this specific hostname is required for DMARC)
Value/Text: A basic DMARC record could be: ‘v=DMARC1; p=none; rua=mailto:[email protected]’ (replace ‘[email protected]’ with an email address where you want to receive DMARC reports).
TTL: Default
Strongly recommend enabling 2FA for all Google Workspace users, especially administrators. This adds an extra layer of security by requiring a second verification step, like a code from a phone app in addition to the password.
Enable 2FA in the Admin Console: Go to Security > Authentication > 2-Step Verification. You can enforce it for all users or specific organizational units.
Users Enable 2FA: Users will then be prompted to set up 2FA for their individual accounts via Google's security settings.
