# Setup a new Business on Google Workspace

*Full guide coming soon ...*

## Reduce the likelihood of Gmail getting into spam

First of all, go and check with the [Google MX Toolbox](https://toolbox.googleapps.com/apps/checkmx/check) what is the situation with your domain. You will get a report like the below:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1685645353622/46732776-b790-432b-9c80-9855fd832a25.png align="center")

The output will help you identify what is needed for an optimal setup.

### Setup SPF records

An SPF (Sender Policy Framework) record identifies the mail servers and domains that are allowed to send emails on behalf of your domain.

* Go to your DNS provider and setup a `TXT` record with the name of your domain followed by a "dot", ie `example.com.` and the value of:
    
* ```plaintext
      v=spf1 include:_spf.google.com ~all
    ```
    
* Your DNS provider should end up being configured like this:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1685645489190/c27760e1-b0f2-4951-9416-9a53c3667dae.png align="center")

A [detailed guide](https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F10684623%3Fhl%3Den&assistant_id=generic-unu&product_context=10684623&product_name=UnuFlow&trigger_context=a) on configuring SPF records is available from Google.

### **Setup DKIM records**

DKIM, or **DomainKeys Identified Mail**, is an email authentication method that uses a digital signature to let the receiver of an email know that the message was sent and authorized by the owner of a domain.

* Go to [https://admin.google.com](https://admin.google.com) and click on `Apps -> Google Workspace -> Gmail`
    
* On the list of options select `Authenticate email`
    
* Click on `GENERATE NEW RECORD` and you will get the below:
    
* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1685646446156/054917dd-98fc-4d95-9910-1ab210c84480.png align="center")
    
    Now go to your DNS provider and create a new `TXT` record with the value in the box. Should look something like this:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1685646493958/1fa353d7-1184-4bb1-a62d-703bb21228fc.png align="center")
    
* Click the `START AUTHENTICATION` button. When DKIM setup is complete and working correctly, the status at the top of the page changes to `Authenticating email with DKIM`.
    
* Well done for making your emails safer, remember to check on [Google MX Toolbox](https://toolbox.googleapps.com/apps/checkmx/check) that everything is OK
    

A [detailed guide](https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F180504%3Fhl%3Den&assistant_id=generic-unu&product_context=180504&product_name=UnuFlow&trigger_context=a) on configuring DKIM records is available from Google.

### Setup DMARC records

Domain-based Message Authentication Reporting & Conformance (DMARC) is **an email security protocol**. DMARC verifies email senders by building on the Domain Name System (DNS), DomainKeys Identified Mail (DKIM), and Sender Policy Framework (SPF) protocols.

A recommended value to begin with is:

```plaintext
v=DMARC1; p=none; rua=mailto:dmarc@example.com
```

This means that when emails fail the DMARC validation, they will still be delivered to the recipient and a report will be sent to `dmarc@example.com`. This will let you review the reports and decide if you want to send the emails that fail the validation to the spam folder or reject them.

* Go to your DNS provider and setup a `TXT` record with the name of `_`[`dmarc.example.com`](http://dmarc.example.com) with the value above. Of course, instead of `example.com`, you should configure your domain name.
    
* The configuration of the DMARC TXT record on your DNS provider should be:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1685655306377/3ce0e888-57ff-438d-96c0-1b3e3b1a1cc4.png align="center")
    

To improve the handling of rejections follow this [tutorial by Google](https://apps.google.com/supportwidget/articlehome?article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F10032473&assistant_id=generic-unu&product_context=10032473&product_name=UnuFlow&trigger_context=a). To see all the possible parameters read this [article on Google](https://apps.google.com/supportwidget/articlehome?article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F10032473&assistant_id=generic-unu&product_context=10032473&product_name=UnuFlow&trigger_context=a).

A [detailed guide](https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F2466563%3Fhl%3Den&assistant_id=generic-unu&product_context=2466563&product_name=UnuFlow&trigger_context=a) on configuring DMARC records is available from Google.

### Setup MTA-STS records

[Mail Transport Agent Strict Transport Security (MTA-STS)](https://www.hardenize.com/blog/mta-sts) is a new internet standard that allows you to enable strict force-TLS for email sent between supported email providers. It is similar to [HTTP Strict Transport Security (HSTS)](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security), where a force-TLS policy is set and then cached for a specified amount of time, reducing the risk of man-in-the-middle or downgrade attacks.

Follow this [detailed guide](https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F9276512%3Fhl%3Den&assistant_id=generic-unu&product_context=9276512&product_name=UnuFlow&trigger_context=a) from Google.

## Conclusion

If all goes well, Google MX toolbox should do a nice and green report like this:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1685656105050/8bd5caf7-b039-47ff-b77b-2796ac19fb7e.png align="center")