If you use Google Workspace for email but host your website with CanSpace, you need to configure your DNS so incoming email goes to Google rather than our servers. This article walks through the DNS records to add.
Where to add the records
Add DNS records in the place that manages your domain's DNS — this depends on where your nameservers point:
- Nameservers at CanSpace (dns1/dns2.canspace.ca, domain-only clients) — add records under Manage DNS Records: How do I manage DNS entries?
- Hosting with CanSpace (nsXX.canspace.ca nameservers) — add records in cPanel's Zone Editor (Domains section)
- Nameservers elsewhere (Cloudflare, another registrar) — add records at that provider
DNS records to add
1. MX record (the essential one)
Google updated their MX requirements in 2023 to use a single smtp.google.com host. This replaces the older five-record ASPMX.L.GOOGLE.COM setup (which still works if you already have it, but the single-record version is easier).
| Type | Name | Priority | Value |
|---|---|---|---|
| MX | @ (or your bare domain) |
1 | smtp.google.com |
Delete any other MX records that were previously pointing at mail.yourdomain.com or similar. Only the Google MX should remain.
2. SPF record
SPF tells receiving servers that Google is authorized to send email for your domain.
| Type | Name | Value |
|---|---|---|
| TXT | @ (or your bare domain) |
v=spf1 include:_spf.google.com ~all |
3. DKIM record
Google generates a DKIM key for you in the Google Workspace admin console. The key isn't static — you'll find it at:
admin.google.com → Apps → Google Workspace → Gmail → Authenticate email → Generate new record
Google will give you a record name (typically google._domainkey) and a long value starting with v=DKIM1;. Copy both and add:
| Type | Name | Value |
|---|---|---|
| TXT | google._domainkey |
(the value Google provided) |
Back in Google's admin console, click Start authentication once the record has had a few minutes to propagate.
4. DMARC record (recommended)
Not strictly required, but highly recommended. Start with a reporting-only policy and tighten it later if you wish.
| Type | Name | Value |
|---|---|---|
| TXT | _dmarc |
v=DMARC1; p=none; rua=mailto:[email protected] |
Replace [email protected] with an email you actually check — this is where Google will send weekly DMARC reports.
If you host your website with us too
There's one more step for hosting clients: tell our mail server to deliver to Google instead of to the local mailbox. We call this email routing.
Open a support ticket and ask us to set email routing to automatic for your domain. Once done, our server will detect the Google MX records and route mail there.
If this step is missed, our server will keep delivering mail to local mailboxes (that you'd read via cPanel's webmail) and Google will never see any incoming mail.
Keep any domain-verification records
When you first set up Google Workspace, you added a google-site-verification=... TXT record. Keep it. Removing it causes Google to stop trusting your domain and eventually disables services.
Testing
- Allow 1-2 hours for DNS propagation after adding the records.
- Send yourself a test email from any outside address (your personal Gmail, for example) to
[email protected]. It should land in your Google Workspace inbox. - Send a test from Google Workspace out to a Gmail/Outlook address. Check the headers for
spf=passanddkim=pass.
Related articles
Still stuck? Open a support ticket
