Configuring Google Workspace (Gsuite)

Situation: You want to set up Spambrella with Google Workspace.

Summary: This guide covers inbound mail flow, outbound mail flow, internal routing, and the DNS and SPF changes needed for a clean cutover.

This article explains how to configure Google Workspace to use Spambrella Email Security as your mail gateway.

What is Google Workspace?

Google Workspace, formerly G Suite, is Google’s cloud productivity and email platform. It provides Gmail, collaboration tools, security, and archiving services from Google’s global cloud infrastructure.

For more information, visit workspace.google.com.

Before you start

Before you begin provisioning and configuration, make sure you have the following information available.

• MX records for each domain you are configuring in Google Workspace
• A Google Admin account with access to Gmail routing and security settings
• Your assigned Spambrella connection details, including service IPs, smart host, MX records, and SPF information

Set up inbound mail flow

Spambrella sits between the internet and your Google Workspace environment. Incoming mail is routed to Spambrella first, then delivered onward to Google Workspace.

1. Configure Spambrella

First, identify the Google Workspace MX destinations that Spambrella should use when relaying mail to your tenant.

1. Sign in to the Google Admin console.
2. Go to Apps > Google Workspace > Gmail > Setup.
3. Under MX records, note the Google “points to” destinations for the domain you are configuring.

These MX values are used as the delivery and failover destinations when you add the domain to Spambrella.

4. Sign in to the Spambrella interface.
5. Go to Administration > Account Management > Domains > New Domain.
6. Enter the domain name.
7. Set the domain purpose to Relay.
8. Set the delivery destination to the primary Google MX target, typically aspmx.l.google.com.
9. Add the additional Google MX targets as failovers.
10. Choose Verify by TXT Record, then click Verify Later if DNS changes are not ready yet.
11. Repeat the process for each domain you plan to route through Spambrella.

The delivery and failover destinations should match the Google Workspace “points to” values you collected in the first step.

2. Configure Google Workspace

Important: Skipping inbound gateway configuration has been known to cause delivery failures when the original sender is subject to SPF or DMARC checks.

1. Sign in to the Google Admin console.
2. Go to Apps > Google Workspace > Gmail > Spam, phishing, and malware.
3. Edit Inbound gateway.
4. Under Gateway IPs, add all of the Spambrella IP addresses for your assigned region from Connection Details.
5. Also allow the Google IP ranges below.

6. Enable Automatically detect external IP.
7. Enable Reject all mail not coming from gateway IPs.
8. Enable Require TLS for connection from the email gateways listed above.
9. Save the settings and enable the inbound gateway.

If Google rejects mail from its own infrastructure, you may need to temporarily clear the “Reject all mail not coming from gateway IPs” option. If you see internal routing or delivery issues, review Bounce Error When Mailing Internally within Google Workspace.

3. Update safety settings

1. In the Google Admin console, go to Apps > Google Workspace > Gmail.
2. Open Safety.
3. If Spoofing and authentication protections are enabled for this flow, disable them to avoid conflicts with the gateway path.
4. Also disable Apply future recommended settings automatically if it would re-enable those controls for this route.

Leaving these controls enabled can trigger DMARC or “trusted source” delivery failures even when the gateway is otherwise configured correctly.

Set up outbound mail flow

To route outbound mail through Spambrella, enable outbound relaying in Spambrella and then configure the appropriate Google Workspace host and routing rules.

1. Enable outbound relaying in Spambrella

1. Sign in to the Spambrella interface.
2. Go to Administration > Features.
3. Enable Outbound Relaying.
4. Save your changes.

2. Add the managed hosted service IP addresses

1. In Spambrella, go to Administration > Domains.
2. Open Managed Hosted Services.
3. Select Google Apps.
4. Save.

3. Configure the Google Workspace outbound gateway

1. Sign in to the Google Admin console.
2. Go to Apps > Google Workspace > Gmail > Hosts.
3. Click Add Route.
4. Name the route appropriately, such as Outbound.
5. Set the outbound gateway host to the smart host value listed in Connection Details.
6. Save the route.

7. Go to Apps > Google Workspace > Gmail > Routing.
8. Create a new rule such as Outbound Through Spambrella.
9. For Email messages to affect, choose Outbound.
10. Enable Change the route and Also reroute spam.
11. Select the outbound route you created earlier.
12. Open Show options.
13. Under account types, include users, groups, and unrecognized or catch-all addresses as needed.
14. Under Envelope Filter, choose Only affect specific envelope senders, switch to Pattern match, and enter your sending domain pattern.

If you have multiple sending domains, either create separate outbound routing rules per domain or use a broader regular expression that safely covers all approved sender domains.

4. Configure internal routing

1. Go to Apps > Google Workspace > Gmail > Hosts.
2. Create a route named Internal Google Workspace.
3. Set the host to aspmx.l.google.com on port 25.
4. Leave Perform MX lookup on host unchecked.
5. Enable secure transport, CA-signed certificate validation, and certificate hostname validation.
6. Save the route.

7. Return to Settings for Gmail > Routing.
8. Create or edit a rule for Internal Sending.
9. Change the route from Normal Routing to Internal Google Workspace.
10. Open Show options.
11. Under account types, include users and groups.
12. Under Envelope Filter, choose Only affect specific envelope senders, switch to Pattern Match, and enter your domain.
13. Save the rule.

When configured this way, mail exchanged internally inside Google Workspace does not pass through Spambrella for spam inspection. Google Workspace changes can also take up to 24 hours to apply fully.

Final DNS and policy changes

• Update your MX records to point to the Spambrella MX values shown in Connection Details.
• Update your SPF record so outbound mail sent through Spambrella is authorized for your domain.
• Use a low DNS TTL before cutover if you want a quicker rollback path during testing.

Further reading

Use these related resources while you complete the rollout and post-cutover checks.

• View Connection Details
• Read Bounce Error Guidance
• Google Workspace Security Overview