Google Workspace email DNS checker
Check the public DNS records that matter when Google Workspace Gmail is not receiving, sending, verifying, or passing authentication for a custom domain.
Google Workspace can run Gmail for a custom domain, but public DNS still decides whether mail is delivered to Google and whether outgoing mail authenticates correctly.
Use this page before changing records to separate Google Workspace setup issues from DNS host mistakes, website hosting records, and provider-generated values that must come from Google Admin.
DNS records to check first
| Record | What to check | Safe note |
|---|---|---|
| MX | Confirm the domain has the current Google Workspace MX destination shown by Google Admin, and remove old MX providers only after migration is complete. | For many new Google Workspace setups, Google uses smtp.google.com, but follow Google Admin if it shows account-specific instructions. |
| SPF | If Google Workspace sends mail for the domain, the SPF record commonly includes _spf.google.com. | Only include Google if Google really sends mail for the domain, and merge with other senders instead of creating a second SPF record. |
| DKIM | Generate the DKIM selector and TXT value in Google Admin, publish the exact value in DNS, then enable DKIM signing. | Do not invent Google verification tokens or DKIM public keys. The values are generated for your Google Workspace account. |
| DMARC | Publish a DMARC record so receivers know how to handle messages that fail SPF or DKIM alignment. | Start with a safe monitoring policy such as p=none unless you already know all legitimate senders pass authentication. |
| Google Admin setup | Confirm the domain is verified, Gmail is activated, and the recipient mailbox, alias, or group exists inside Google Workspace. | A correct MX record routes mail to Google, but it does not create the mailbox or alias. |
Common mistakes
- Adding Google records at the registrar while live nameservers point to Cloudflare or another DNS host.
- Leaving old Microsoft 365, cPanel, forwarding, or web-host MX records after migration.
- Adding a second SPF record instead of merging Google with the existing sender list.
- Assuming a working website means Google Workspace email DNS is also correct.
Boundaries
Domain Email Doctor checks public DNS records only.
Google Admin, Gmail activation, mailbox creation, aliases, billing, and account access stay inside Google Workspace.
Provider-generated verification and DKIM values must come from Google Admin.