Set Up Google Workspace MX Records
MX records are the DNS entries that tell the world’s mail servers where to deliver your domain’s email. For Google Workspace this used to take five records — since 2023 it takes one.
What you’ll need: access to your domain’s DNS settings (your registrar or DNS host).
The current record — one line
For any domain being set up today, Google’s recommended MX configuration is a single record:
| Name/Host | TTL | Type | Priority | Value |
|---|---|---|---|---|
Blank or @ |
Your host’s default (3600 is typical) | MX | 1 | smtp.google.com |
That’s the whole table. Add it, remove any other MX records the domain has (old mail providers’ records left behind will misroute your mail), and save.
Already on the legacy five records?
Domains set up before 2023 typically carry this set — it still works, and Google says no change is required if your mail is flowing:
| Name/Host | TTL | Type | Priority | Value |
|---|---|---|---|---|
Blank or @ |
3600 | MX | 1 | ASPMX.L.GOOGLE.COM |
Blank or @ |
3600 | MX | 5 | ALT1.ASPMX.L.GOOGLE.COM |
Blank or @ |
3600 | MX | 5 | ALT2.ASPMX.L.GOOGLE.COM |
Blank or @ |
3600 | MX | 10 | ALT3.ASPMX.L.GOOGLE.COM |
Blank or @ |
3600 | MX | 10 | ALT4.ASPMX.L.GOOGLE.COM |
Keep it as a set: if you ever modernize, replace all five with the single
smtp.google.com record in one edit — don’t run a mix of both.
How priority works
Mail is delivered to the server with the lowest priority number first
(‘1’ beats ‘10’); if that server is unavailable, delivery falls through to
the next. With the modern single record there’s nothing to rank — set
priority 1 and move on. On the legacy set, ASPMX.L.GOOGLE.COM must hold
the top spot. (Hosts express priority differently; if yours allows only one
MX record or doesn’t rank at all, use the single-record setup.)
Verify it
DNS changes can take up to 48 hours to propagate, though it’s usually much faster.
- Run your domain through Google’s MX checker — it flags wrong values, stray records, and priority problems.
- Or from a terminal, substituting your domain:
dig MX <your-domain> +short
You should see either 1 smtp.google.com. or the five aspmx records — and
nothing else.
Fast path: on Cloudflare, import everything at once
If the domain’s DNS is on Cloudflare, you can skip adding records one by one:
DNS → Records → Import and Export → Import DNS records accepts a BIND
zone file. The snippet below sets up the complete Google Workspace email DNS
— routing and authentication — in one paste. Replace both
<placeholders> first (and note TTL 1 means “Auto” to Cloudflare):
;; Google Workspace email DNS — Cloudflare import (TTL 1 = Auto)
;; MX — mail routing (current single-record setup)
@ 1 IN MX 1 smtp.google.com.
;; SPF — authorized senders
@ 1 IN TXT "v=spf1 include:_spf.google.com ~all"
;; Domain verification — string from the Workspace setup wizard
@ 1 IN TXT "google-site-verification=<your-verification-string>"
;; DMARC — monitoring mode to start (see the SPF/DKIM/DMARC guide)
_dmarc 1 IN TXT "v=DMARC1; p=none"
;; DKIM can't be templated — generate your per-domain key in the Admin
;; console first, then add it as its own record:
;; google._domainkey 1 IN TXT "<your-DKIM-record-value>"
Three follow-ups after importing:
- Delete any leftover MX records from a previous provider.
- Check for a pre-existing SPF record — a domain may have only one (two SPF records make SPF fail outright). If one exists, merge instead of importing a duplicate.
- The imported DMARC record starts in monitoring mode (
p=none), which is safe to publish immediately — it enforces nothing. Before tightening the policy, finish DKIM and give the records ~48 hours, per the SPF, DKIM, and DMARC guide.
While you’re in DNS
Email that routes correctly still needs to authenticate to stay out of spam folders — if you haven’t yet, set up SPF, DKIM, and DMARC while you’re logged into your DNS host. It’s the same kind of record and takes about half an hour.