Google Workspace
Google Workspace Email Admin: DNS, Deliverability and Migration
Google Workspace runs Gmail well, but the admin essentials — DNS, authentication, deliverability and migration — still need doing right. This guide covers what a Google Workspace administrator should get in place for reliable, trusted business email.
Google Workspace gives small businesses Gmail-grade email with a capable admin console behind it. The infrastructure is reliable, but a handful of administrator responsibilities still decide whether your email is trusted, deliverable and secure — and they are easy to overlook when everything appears to "just work".
This guide walks through the practical essentials for a Google Workspace administrator: getting DNS and MX records right, configuring authentication so Gmail and other receivers trust your mail, keeping deliverability healthy, and migrating cleanly into Workspace.
In short
What a Google Workspace admin should get right
These essentials underpin trusted, reliable email on Google Workspace.
-
Correct DNS and MX
Point MX records at Google's mail servers and remove stale records so incoming mail routes cleanly.
-
Authentication configured
Set SPF, DKIM and DMARC for your domain so Gmail and other receivers trust your mail and your domain cannot be spoofed.
-
Admin console hardened
Enforce 2-step verification, manage admin roles carefully and review routing and security settings.
-
Deliverability watched
Keep authentication aligned, watch for blacklisting, and ensure third-party senders are authorised.
-
Clean migration
Move mailboxes, calendars and contacts into Workspace with verification and a planned DNS cutover.
DNS and MX records
When you set up Google Workspace, you point your domain's MX records at Google's mail servers so incoming mail is delivered to Gmail. This is the most fundamental configuration step, and getting it wrong — or leaving old records behind — causes bounces and lost mail.
Remove stale records
A common problem after migration is leftover MX records from a previous provider. Mixed or conflicting MX records can route some mail to the wrong place. After cutover, confirm that only Google's MX records remain and that they have fully propagated before decommissioning the old system.
Beyond MX, you publish the authentication records covered next, plus any records Google requires to verify domain ownership. Treat DNS as a deliberate, documented part of the setup rather than something to rush through.
Authentication for Gmail deliverability
Authentication is as important on Google Workspace as anywhere else. Google itself tightened sender requirements in 2024, so correctly configured SPF, DKIM and DMARC are now effectively mandatory for reliable delivery — including, ironically, delivery to other Gmail recipients.
- Publish an SPF record that authorises Google Workspace and every third-party tool that sends as your domain.
- Turn on DKIM signing for your domain in the Google Admin console — it is not enabled by default and is frequently missed.
- Add a DMARC record, start at monitoring, then move to enforcement once your mail aligns.
DKIM in Google Workspace is off until you explicitly generate the key and publish it. Because mail flows without it, this step is one of the most commonly overlooked — and one of the highest-impact to fix.
Keeping deliverability healthy
Google Workspace gives you strong baseline deliverability because you send through Google's reputable infrastructure. But your domain reputation and your own configuration still matter, and they are the parts you control.
Mind your third-party senders
Tools that send as your domain — CRM, invoicing, marketing, helpdesk — must be authorised in SPF and aligned for DMARC. Unaligned third-party senders are a leading cause of authentication failures even on a well-run Workspace tenant, and they quietly damage deliverability.
Watch for your domain appearing on blacklists, keep authentication aligned as you add new sending tools, and avoid unsolicited bulk sending. These habits keep your mail reaching the inbox rather than the spam folder.
The admin console and security
The Google Admin console is where you manage users, security and mail routing. A few settings deserve particular attention because they protect both your accounts and your email.
- Enforce 2-step verification for all users, and especially for administrators.
- Apply least privilege to admin roles — grant only what each person needs.
- Review mail routing and any catch-all or forwarding rules for anything unexpected.
- Use the security and alert centre to spot suspicious sign-ins and account activity early.
As with any platform, a compromised account often shows up as unexpected forwarding rules or filters that hide incoming mail. Periodically reviewing for these is a quick, high-value check that catches problems before they spread.
Migrating into Google Workspace
Moving to Google Workspace from another provider follows the same disciplined method as any email migration: move the data, switch mail flow, and validate, all without losing messages or causing downtime.
- Audit the source environment — mailboxes, calendars, contacts, shared resources and senders.
- Provision users and migrate mailbox data with verification so nothing is left behind.
- Configure authentication for the new tenant before cutover, not after.
- Switch MX records as a planned cutover and confirm propagation.
- Keep the old system available as a tested rollback until the move is proven.
- Validate with send-and-receive tests and inbox-placement checks.
Our email migration checklist covers this method in full and applies directly to a Google Workspace move.
Avoid these
Common Google Workspace admin mistakes
These oversights cause most of the avoidable problems on Workspace.
-
Leaving DKIM disabled
DKIM is off until you generate and publish the key. Because mail flows without it, it is frequently missed — weakening deliverability and spoofing protection.
-
Stale MX records after migration
Leftover records from a previous provider route some mail to the wrong place. Confirm only Google's MX records remain after cutover.
-
Forgetting third-party senders
CRM, invoicing and marketing tools that send as your domain must be authorised in SPF and aligned for DMARC, or authentication fails for that mail.
-
Not enforcing 2-step verification
Optional 2-step verification leaves accounts protected only by a password. Enforce it for everyone, especially admins.
-
Treating DMARC as optional
Without DMARC at enforcement your domain can still be spoofed. Monitoring first, then enforcement, closes the gap safely.
When to call a specialist
When to get expert help
Workspace handles a lot for you, but a few situations are worth expert hands.
-
You are migrating to Workspace
Moving mailboxes, calendars and contacts without loss or downtime, with a tested rollback, is specialist work whatever the platform.
-
Your Gmail mail is going to spam
If mail from your domain lands in spam despite Google's infrastructure, the cause is usually authentication, alignment or reputation — we diagnose it.
-
You need DMARC at enforcement
Reaching enforcement without blocking legitimate mail across all your senders takes careful, report-driven work.
-
You want it monitored
Watching sign-ins, rules and deliverability over time — with a defined response — keeps small problems from becoming big ones.
A note on honesty
Need it handled?
Related Mailoza services
From migration to day-two operations, we keep Google Workspace email trusted and deliverable.
Keep reading
Related guides
A few more plain-English guides that connect to this one.
-
Microsoft 365 Email Security
The equivalent security and DNS essentials for a Microsoft 365 tenant.
-
SPF, DKIM and DMARC Explained Simply
How to configure the authentication records Google now effectively requires.
-
Email Migration Checklist
The step-by-step method for moving into Google Workspace cleanly.
Questions
Frequently asked questions
Do I need SPF, DKIM and DMARC on Google Workspace?
Yes. Google tightened its sender requirements in 2024, so correctly configured SPF, DKIM and DMARC are effectively mandatory for reliable delivery — including to other Gmail recipients. DKIM in particular must be turned on explicitly; it is off until you generate and publish the key.
Why is my DKIM not working on Google Workspace?
Usually because it was never enabled. DKIM signing is off by default in Google Workspace — you generate the key in the Admin console and publish it in DNS. Because mail flows without it, this step is one of the most commonly overlooked.
My mail goes to spam even though I use Gmail — why?
Sending through Google's infrastructure gives strong baseline deliverability, but your domain reputation, authentication and configuration still matter. The usual culprits are missing or misaligned DKIM and DMARC, or unauthorised third-party senders. A diagnosis pinpoints which applies.
How do I migrate to Google Workspace without losing email?
Audit the source environment, migrate mailbox data with verification, configure authentication before cutover, switch MX records as a planned cutover, keep the old system as a tested rollback, and validate afterwards. The same disciplined method applies as any email migration.
What should I do about old MX records after migrating?
Remove them. Leftover MX records from a previous provider can route some mail to the wrong place. After cutover, confirm that only Google's MX records remain and have fully propagated before decommissioning the old system.
How do I secure admin access in Google Workspace?
Enforce 2-step verification for all users and especially administrators, apply least privilege to admin roles, review mail routing and forwarding rules for anything unexpected, and use the security and alert centre to catch suspicious sign-ins early.