How to Set Up MX Records for Google Workspace

Google Workspace (formerly G Suite) lets you use business email in the form [email protected], backed by Google's Gmail, Calendar, and Drive. The key that makes it work is the MX record — the record on your domain that tells the internet which server this domain's email should be delivered to. This guide explains how MX records work, how to point them to Google, and the common mistakes that leave email broken.

What Is an MX Record and Why Google Workspace Needs It

An MX record (Mail Exchange record) is a type of DNS record on your domain that specifies which server is allowed to receive incoming email for that domain. Every time someone sends a message to [email protected], the sending server first looks up the MX record for yourdomain.com, then delivers the message to the server it points to, following the priority order. If the MX record points to the wrong place — or is missing entirely — email will not arrive and usually bounces back with an error immediately.

Once you sign up for Google Workspace, Google receives and stores all your email through Gmail. That means your domain must point its MX records at Google's mail servers. This step is the bridge between the domain name you own and the mailbox inside Google's system. You make the change wherever your domain's authoritative DNS lives — for AsiaGB customers using the default DNS, that is the DirectAdmin control panel.

Google Workspace MX Records Table

Google Workspace (per Google's documentation) uses five MX records with the priorities shown below. Set the Host to @ (or leave it blank, depending on your control panel), and a TTL of 3600 seconds (1 hour) is a fine standard value:

Priority (some panels call it Preference) means lower numbers are tried first — the sending server attempts ASPMX.L.GOOGLE.COM (priority 1) first, then falls back to ALT1/ALT2 (priority 5) and ALT3/ALT4 (priority 10) in order. All five values must be present; do not add just a few, or you lose the built-in fault tolerance (redundancy).

Step-by-Step: Setting MX Records in DirectAdmin

Follow this order to move your domain's email to Google Workspace safely, without disrupting other services (subdomains, websites, and so on) on the same domain:

1. Verify domain ownership with a TXT record first — the Google Admin Console gives you a TXT verification value (for example google-site-verification=xxxxxxxx). Add it as a TXT record in DirectAdmin DNS Management, then confirm verification in Google before anything else. This proves you actually own the domain.
2. Delete all existing MX records — go to DirectAdmin → E-Mail Manager → MX Records, select the domain, and remove every old MX record (for example from a previous email host, or records pointing back to the hosting server) so they do not mix with Google's.
3. Add all five Google MX records — enter each value from the table above one by one, setting the priorities correctly (1 / 5 / 5 / 10 / 10).
4. Disable "Use this server to handle my emails" — if DirectAdmin offers an option for the server to handle mail locally, turn it off so the server forwards mail out to Google instead of keeping it.
5. Click Save and wait for DNS propagation — save the records, then allow DNS to spread worldwide, which usually takes 15 minutes to 48 hours depending on the previous record's TTL.

Steps to Configure in DirectAdmin (Quick Summary)

1. Log in to DirectAdmin
2. Go to E-Mail Manager → MX Records
3. Select your domain
4. Delete all existing MX records first
5. Add each Google MX record one by one using the table above
6. Click Save

Set Up SPF Record (Critical)

Add a TXT record so Google Workspace can send mail without being flagged as spam:

Go to DNS Management → add a TXT record:

Name: @ (or your domain)

Value: v=spf1 include:_spf.google.com ~all

Set Up DKIM (Recommended)

Enable DKIM in the Google Workspace Admin Console under Gmail → Authenticate Email. Copy the generated DKIM key and add it as a TXT record in DirectAdmin's DNS Management. This significantly improves email deliverability.

Set Up SPF, DKIM, and DMARC for Google Workspace

Pointing the MX records alone lets you receive email, but if you want your outgoing mail to avoid being flagged as spam — and to stop others from spoofing your domain — you need all three authentication records. All three are TXT records added in DirectAdmin DNS Management:

1) SPF — Declares Who Can Send on Your Behalf

SPF specifies which servers are authorized to send email for your domain. For Google Workspace, a single value is enough:

Type: TXT
Host: @
Value: v=spf1 include:_spf.google.com ~all

You must never have more than one SPF record per domain. If an SPF record from another provider already exists, merge them into a single line (chain the include: mechanisms together) rather than creating a separate new TXT record.

2) DKIM — A Digital Signature Against Tampering

DKIM attaches a cryptographic signature to every message. The recipient uses the public key published in your DNS to verify the message was not altered in transit. Enable it under Admin Console → Apps → Google Workspace → Gmail → Authenticate Email, which gives you a host (usually google._domainkey) and a long value. Add it as a TXT record:

Type: TXT
Host: google._domainkey
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3...

3) DMARC — The Policy When SPF/DKIM Fail

DMARC tells receiving servers what to do with messages that claim your domain but fail SPF/DKIM, and it sends you aggregate reports. Start safely with a "none" policy to monitor first:

Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:[email protected]

Once you are confident your legitimate mail passes SPF and DKIM, raise the policy to p=quarantine and then p=reject to firmly block forged mail that impersonates your domain.

Common Problems and How to Fix Them

Email Not Arriving in the Gmail Inbox

The most common cause is DNS that has not propagated yet, or MX records that are not entered as all five values. Use an MX lookup tool (such as MX Toolbox) to check whether your domain shows all five ASPMX.L.GOOGLE.COM entries. If you still see the old server lingering, wait for the TTL to expire or go back and remove any leftover old MX records.

Old MX Records Lingering / Mail Split in Two Places

If you did not delete every old MX record, incoming mail gets split between the old server and Google — some messages land in Gmail while others stay stuck on the old server. The fix is to open DirectAdmin, remove every MX record that is not Google's so only the five Google values remain, and remember to disable the server's local mail option.

Domain Verification Fails

If Google reports that verification failed, check that the TXT verification value is placed at the root domain host (@) rather than a subdomain, and that you copied the value completely with no extra spaces. Sometimes you must wait a few dozen minutes for DNS to propagate before retrying. Do not delete the TXT verification record even after it succeeds, because Google may re-check it periodically.

Outgoing Mail Landing in Recipients' Spam Folder

This usually means SPF/DKIM/DMARC is incomplete or misconfigured. Check that SPF contains include:_spf.google.com and that only one record exists, confirm that DKIM is actually enabled in the Admin Console (not just generated as a key), and verify that DMARC is declared correctly. Once all three pass, your email's reputation score improves noticeably.

Wait for DNS Propagation

After saving MX records, allow 15 minutes to 48 hours for DNS propagation. Test by sending a message to your new email address or use MX Toolbox (mxtoolbox.com) to verify the records are live.

Frequently Asked Questions

Does email work immediately after setting MX records?

Not instantly. You must wait for DNS propagation — from a few minutes to several hours, depending on the previous record's TTL.

Should I remove the old MX records first?

Yes — remove all old MX records (from a previous email host or provider), leaving only Google's. Otherwise email may be delivered to the wrong server.

Where do I set MX records — at the domain or the hosting?

Set them wherever your domain's authoritative DNS is. If you use AsiaGB's DNS, set them in DirectAdmin; if you moved DNS to Cloudflare, set them in Cloudflare.

Do I need to set up SPF, DKIM, and DMARC all together?

MX records alone are enough to receive email, but if you want outgoing mail to avoid the spam folder and to prevent domain spoofing, we recommend setting up all three: SPF, DKIM, and DMARC. At a minimum SPF and DKIM should always be present, while DMARC can start at p=none for monitoring before you raise it.