How to Set Up MX Records for Google Workspace

Google Workspace gives you Gmail on your own domain, but mail only flows once your MX records point at Google. This guide gives the exact records to add — MX, SPF and DKIM — at any registrar, and shows how to verify they're live.

Step 1: The modern single MX record

Google used to require five MX records; new setups use just one:

example.com.  MX  1  smtp.google.com.

• Type: MX
• Name/Host: @ (your root domain)
• Priority: 1
• Value/Target: smtp.google.com (some panels want a trailing dot: smtp.google.com.)
• TTL: 3600

If your registrar still shows the older 5-record setup, that also works:

1   ASPMX.L.GOOGLE.COM.
5   ALT1.ASPMX.L.GOOGLE.COM.
5   ALT2.ASPMX.L.GOOGLE.COM.
10  ALT3.ASPMX.L.GOOGLE.COM.
10  ALT4.ASPMX.L.GOOGLE.COM.

Use one scheme, not both. Delete any pre-existing MX records (parking or a previous provider) first — leftover MX records from another host will misroute or bounce mail.

Step 2: Add SPF so your sending passes

Publish a single SPF TXT record authorising Google to send as you:

example.com.  TXT  "v=spf1 include:_spf.google.com ~all"

Only one SPF record per domain — if you already have one (say for a marketing tool), merge the include: terms into it rather than adding a second. Details in how to set up SPF, DKIM and DMARC step by step.

Step 3: Turn on DKIM in the Admin console

DKIM isn't automatic — you generate the key in Google. In the Admin console go to Apps → Google Workspace → Gmail → Authenticate email, generate a 2048-bit key, and Google gives you a TXT record like:

google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

Add it to DNS, wait, then click Start authentication in the console. Background: how to verify your domain for email sending.

Step 4: Add DMARC

Once SPF and DKIM pass, add a DMARC policy:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Start at p=none to monitor, then tighten. This trio is what keeps you out of spam — see how to stop your emails going to spam.

Step 5: Verify

dig example.com MX +short
dig example.com TXT +short
dig google._domainkey.example.com TXT +short

The MX query should return smtp.google.com (or the ASPMX set). Send a test message in and out and confirm delivery. If MX still shows an old host, you didn't delete the previous records — see diagnosing DNS problems with dig and nslookup.

Migrating from another provider to Google

If mail currently flows somewhere else, cut over cleanly rather than flipping MX blind:

1. Add and verify the domain in the Google Admin console (a TXT or CNAME ownership record).
2. Create every user mailbox in Google *before* changing MX, so mail has somewhere to land.
3. Import old mail with Google's Data Migration Service over IMAP.
4. Lower your MX TTL to 300 a day ahead.
5. Delete the old MX records and add Google's single smtp.google.com record.

Leftover MX records from the previous host are the number-one cause of post-migration bounces — remove them all. The general playbook is in how to set up business email on a custom domain.

Subdomain addressing and aliases

Google Workspace lets one mailbox own several addresses without extra cost:

• Aliases: add sales@, hello@ as aliases of a real user or a Group — no extra licence.
• Groups: team@example.com fans a message out to several people; great for shared role addresses.
• Plus-addressing: you+shop@example.com already routes to you@, handy for filtering — no setup needed.

For catching *every* possible address, Google supports a routing rule for unrecognised addresses — see how to set up a catch-all email address, and weigh the spam trade-off before enabling it.

Optional client autodiscovery records

Desktop and mobile mail clients set up faster if you publish the CNAMEs Google recommends so apps auto-find the right servers:

mail.example.com.  CNAME  ghs.googlehosted.com.

That lets you offer mail.example.com as a friendly webmail address that redirects to Gmail. It's optional — Gmail works without it — but it's a nice touch for staff. Verify any record you add with a quick lookup:

dig mail.example.com CNAME +short

If a client still can't connect, the issue is almost always MX not yet propagated or a typo, both diagnosable with dig and nslookup.

FAQ

How long until Google Workspace email starts working?

Once MX records propagate — often under an hour, up to 48 hours — mail begins flowing to Gmail. Google's setup wizard shows an "Activated" status when it detects the records.

Can I keep my website where it is and just move email to Google?

Yes. MX records control email independently of your website's A record. Point MX at Google and leave your site's A record untouched.

Do I still need SPF and DKIM if I use Google Workspace?

Yes. MX handles receiving; SPF, DKIM and DMARC handle sending reputation. Without them your outbound Gmail may land in recipients' spam.

Why is my mail bouncing after adding Google MX?

Usually leftover MX records from a previous provider, or a typo in the target hostname. Remove old MX records and confirm the value is exactly smtp.google.com.

Can I use a subdomain for Google Workspace email?

Yes. You can run Google Workspace on a subdomain like mail.example.com or a departmental one such as eu.example.com by adding the MX record (pointing to smtp.google.com) on that subdomain instead of the root, plus SPF and DKIM records scoped to it. Google supports this as a domain alias or secondary domain in the Admin console. It's useful when the root domain's email is handled elsewhere, or for separating regions or brands. The records follow the same pattern as the root, just anchored on the subdomain label — verify with dig mail.example.com MX +short. Bear in mind users' addresses then include the subdomain (jane@mail.example.com), so most businesses keep primary mail on the bare domain and reserve subdomain email for specific cases.

Prefer someone else handles mailboxes, DKIM and reputation on your domain? Nxeon business email does exactly that, and you can register the domain through Nxeon domains.