How to add Google Workspace mail DNS records

Applies to: All plans. If you ordered your seats through us, we configure these records for you — you can skip the manual steps below, whatever your hosting plan.

Before you start: You need your client area login (my.maxinodes.com), Google Workspace set up for your domain, and access to the Google Workspace admin console (admin.google.com) to read your exact DKIM value. Your domain must point at our nameservers so DNS is managed in the client area.

To get Google Workspace email delivering on your domain, you add three DNS records — MX (so mail routes to Google), SPF (so your mail passes authentication) and DKIM (so Google signs your outgoing mail) — plus an optional DMARC record. You add all of them in your client area DNS manager, not in the cPanel zone editor. Your mailboxes live in Google Workspace, so these records point at Google, not at our hosting server.

With Google Workspace, you read your mail in Gmail at mail.google.com, and these records connect your domain to Google Workspace. They take the place of the records for the mailboxes included in your hosting plan (see Email at Maxinodes).

Step 1 — Get your DKIM value from Google

The MX and SPF values below are the same for every Google Workspace tenant, but your DKIM value is unique to your domain and must be copied from Google.

1. Sign in to the Google Workspace admin console at admin.google.com.
2. Open the option for authenticating email (DKIM) for your domain and choose to generate a new record.
3. Google shows you a TXT record to add — note the host name (it starts with google._domainkey) and copy the long DKIM value exactly.

Result: You have your DKIM TXT value ready to paste. Do not start the DKIM "Start authentication" step in Google until the record is live (Step 4).

Step 2 — Open your client area DNS manager

1. Go to my.maxinodes.com and select Login.
2. Open Domains from the top menu (or your service under Services -> My Services) and open the DNS management option for your domain.

Result: You see the list of current DNS records for your domain.

Step 3 — Add the records

First, replace the records for the included mailboxes. A hosting zone on our nameservers is created with the records for the mailboxes included in your plan, unless your domain already used Google Workspace or another outside mail provider at that moment (then that provider's records were copied instead). Don't add Google's records alongside ours:

• delete the MX record mx.maxinodes.com: a leftover MX sends some of your mail to our server;
• edit our SPF record (v=spf1 include:_spf.maxinodes.com ~all) into Google's instead of adding a second one, which would break SPF. If your website still sends mail from our server (contact forms, shop receipts), keep include:_spf.maxinodes.com in it, for example v=spf1 include:_spf.google.com include:_spf.maxinodes.com ~all;
• edit the existing _dmarc record rather than adding a second one;
• delete the autoconfig and autodiscover A and AAAA records and the SRV record _autodiscover._tcp, which point mail apps at our server. Leave _mailchannels and default._domainkey in place: they are used for mail your website sends from our server.

Then add each record below in the DNS manager. Use @ for the root domain.

A few things to watch:

• One SPF record only. Your domain must have a single SPF TXT record. If you already send from another service, merge the include: parts into one line rather than adding a second SPF record.
• Older tenants use five MX records. The single smtp.google.com MX record applies to most Workspace accounts. Some older tenants use five separate ASPMX.L.GOOGLE.COM records instead — follow whatever Google's setup wizard shows for your domain.
• Paste the DKIM value exactly. A single missing character stops DKIM working. Copy it straight from the admin console.

Result: The new records appear in the list and begin to propagate — usually within minutes, occasionally up to a few hours.

Step 4 — Turn on DKIM in Google

Once the records are live, return to the Google Workspace admin console and choose to start authentication (turn on DKIM) for your domain. Google checks the record you added and confirms when signing is active.

Result: Mail sent from your domain now routes through Google and is signed with DKIM. Send a test message to a personal address to confirm it arrives.

Troubleshooting this task

• Google says the DKIM record isn't found. DNS takes time to propagate. Wait a little, confirm the host is exactly google._domainkey, and re-check. Make sure your domain points at ns1.maxinodes.com and ns2.maxinodes.com at your registrar.
• Mail still isn't arriving. Check the MX record reads smtp.google.com with priority 1 (or the five ASPMX.L.GOOGLE.COM records for older tenants), and that there are no leftover MX records pointing elsewhere, such as mx.maxinodes.com.
• Outgoing mail lands in spam. Confirm SPF is present as a single record and that DKIM is turned on in Google (Step 4). Adding a DMARC record (p=none to start) helps too.
• I edited records in cPanel and nothing changed. DNS is managed in the client area, not the cPanel zone editor. Make every change in the client area DNS manager.
• Mail your website sends to your own addresses doesn't reach Google. Our server may still treat your domain's mail as local. In cPanel, open Email Routing and choose Remote Mail Exchanger for the domain (or ask us), and make sure the same addresses don't also exist as mailboxes in your hosting plan.

Related articles

• The DNS records your email needs (MX, SPF, DKIM, DMARC)
• How to manage DNS records in your client area
• How email works at Maxinodes (Microsoft 365 & Google Workspace)
• How to add Professional Email to your hosting