Configuring Google Workspace (Gsuite)

Setup EMP Cloud with Google Workspace (Gsuite) service for both Inbound and Outbound mail flow.

This article explains how to configure Google Workspace (Gsuite) to use EMP Cloud Email Security (SES) as your mail gateway.

What Is Google Workspace?

Google Workspace (also known as Gsuite) is a cloud-based solution from Google which offers email, messaging, security, archiving and other capabilities delivered from Google’s worldwide network of cloud data centers.

For more information please see: https://workspace.google.com

Before You Start

Before continuing with the provisioning and configuration of the EMP Cloud service, it is recommended that you have the information listed below.

INFORMATION NEEDED FOR CONFIGURING EMP Cloud

• MX record(s) for domain(s) you are configuring

INFORMATION NEEDED FOR CONFIGURING G SUITE

• EMP Cloud IPs, Smart Host, and SPF
• Google Admin Account

Setup Inbound Mail Flow

EMP Cloud is deployed between the customer’s Google Workspace environment and the Internet. Inbound mail is routed to EMP Cloud by changing the customer’s MX records. After email is processed by EMP Cloud it is routed to Google Workspace.

Configure EMP Cloud

LOCATE YOUR MX RECORD FOR THE DOMAIN IN G SUITE

• Sign-In to the Google Admin console.
• From the dashboard go to Apps > Google Workspace > Gmail > Setup.
• Under Setup, scroll down to MX records and make note of all the Points to values (you can also enter MX records in the search field)

These values will be necessary when you add your domains to EMP Cloud.

ADDING DOMAIN(S) TO EMP Cloud

• Sign-in to the EMP Cloud user interface.
• Navigate to Administration > Account Management > Domains > New Domain.
• Enter the domain name you wish to configure.
• Ensure Relay is selected for domain purpose.
• For Delivery Destination, put the MX record from Google that you copied earlier (Generally is ASPMX.L.GOOGLE.COM).
• For the subsequent Failovers, put the additional MX Records there (i.e. SMTP Failover 1: ALT1.ASPMX.L.GOOGLE.COM).

You can verify your domain at this stage or you can verify at a later time. However, the domain must be verified before it can be enabled.

• Under Verification Method, select Verify by TXT Record, and then press Verify Later.
• Repeat if you are adding more than 1 domain.

The delivery and failover destinations refers to the points to values captured in the previous section.

Configure Google Workspace

CONFIGURE INBOUND MAIL GATEWAY

Skipping Inbound Mail Gateway Configuration

Skipping this step has been verified to cause bounce errors if the original sender side has a valid SPF or DMARC configuration in place. Please ensure to set this in order to ensure mail delivery.

• Sign-In to the Google Admin console.
• From the dashboard go to Apps > Google Workspace > Gmail > Spam, phishing, and malware
• Hover the cursor to the right of Inbound gateway and click on the pencil icon.
• Under Gateway IPs, enter the IP addresses, as well as these Google IP addresses:

35.190.247.0/24 64.233.160.0/19         66.102.0.0/20         66.249.80.0/20         72.14.192.0/18 74.125.0.0/16        108.177.8.0/21         173.194.0.0/16         209.85.128.0/17

216.58.192.0/19 216.239.32.0/19 172.217.0.0/19 172.217.32.0/20 172.217.128.0/19 172.217.160.0/20         172.217.192.0/19         172.253.56.0/21         172.253.112.0/20

108.177.96.0/19 35.191.0.0/16 130.211.0.0/22 2001:4860:4000::/36 2404:6800:4000::/36 2607:f8b0:4000::/36         2800:3f0:4000::/36         2a00:1450:4000::/36         2c0f:fb50:4000::/36

Check Automatically detect external IP.

When this setting is enabled, Gmail scans the message header to locate the first occurrence of an IP address that is not listed in the Gateway IPs. This is referred to as the “external IP.” Gmail considers the “external IP” as the sending IP and uses this IP for SPF checks and spam evaluation.

• Check Reject all mail not coming from gateway IPs.
• Check Require TLS for connection from the email gateways listed above.
• Click Save and then Enable the Inbound Gateway.

UPDATE SAFETY SETTINGS

G Suite’s safety settings allow organizations to enable or disable policies related to viewing and accessing email. If you have enabled some or all of these settings you may experience some delivery issues. Please review the following steps to ensure your settings are supported.

• While signed into the Google Admin console, go to Apps > Google Workspace > Gmail.
• Click Safety to expand options.

No changes to Attachments Settings or Links and External Images are required. You can leave these settings as they are.

• If you have Spoofing and authentication settings enabled (either all or customized) consider the following setting:
  • Protect against any unauthenticated emails
    • EMP Cloud/Proofpoint has already scanned incoming emails for SPF and/or DKIM issues. Emails with issues are scored accordingly and quarantined if they exceed your spam threshold.
    • This setting needs to be disabled. If it is enabled it may cause unexpected delivery issues for incoming email.
    • Uncheck “Apply future recommended settings automatically” as this may cause the “Protect against any unauthenticated emails” to be checked again causing the error

DMARC Errors

Not disabling this feature has also been known to cause bounce back errors indicating a DMARC issue. Please ensure you disable this as instructed.

The error message would be: Unauthenticated email is not accepted due to domain’s DMARC policy

Setup Inbound And Outbound Mail Flow

EMP Cloud is deployed between the customer’s Google Workspace environment and the Internet. Outbound mail is routed to EMP Cloud/Proofpoint by configuring an outbound mail gateway. This will route all outbound mail to EMP Cloud.

Configure EMP Cloud

ENABLE OUTBOUND RELAYING

• Sign-in to the EMP Cloud user interface.
• Navigate to Administration > Features.
• Check Enable Outbound Relaying.
  

• 
  

• Click Save.

ADD SERVICE IP ADDRESSES TO YOUR INBOUND GATEWAY

• While logged into the EMP Cloud user interface, navigate to Administration > Domains.
• Click Managed Hosted Services.

• Choose Google Apps.
• Click Save

Configure Google Workspace

CONFIGURE OUTBOUND MAIL GATEWAY

• Sign-In to the Google Admin console.
• From the dashboard go to Apps > Google Workspace > Gmail > Routing.
• Highlight Outbound Gateway and click on the pencil icon on the right side
• In the Outbound Gateway text field, enter the Smart host value.
  

• Click Save.
• Click Settings for Gmail in the upper left, then click on Hosts (or go to https://admin.google.com/ac/apps/gmail/hosts)
• Select Add Route.
• For Name, put Internal Google Workspace, for single host, put ASPMX.L.GOOGLE.COMand then put 25.
• Make sure that Perform MX lookup on host is NOT checked, and that Require mail to be transmitted via a secure connection, Require CA signed certificate, and Validate certificate hostname are checked, then press Save.

• Click Settings for Gmail in the upper left again, then click Routing.
• Scroll down to Routing, and then press Configure.
• For the description at the top, put Internal Routing.
• Under Messages to affect, check the box that says Internal Sending.
• Scroll down, and under Route, check Change route, and then change the dropdown from “Normal Routing” to Internal Google Workspace.
• Scroll down and select Show options
• Under B. Account types to affect, select Users
• Under C. Envelope Filter, select Only affect specific envelope senders and then change the dropdown from “Single email address” to Pattern Match
• Under Regexp, put your domain there (ie domain.com)

• Press SAVE in the lower right.

Please Note: When configured as per the instructions above, internal to internal email stays within Google Workspace and is NOT scanned for Spam by EMP Cloud.

UPDATE SENDER POLICY FRAMEWORK (SPF)

When sending outbound email through the EMP Cloud gateway, recipients receive mail sent from EMP Cloud rather than G Suite mail servers. If the recipient’s mail service attempts to verify that the message came from your domain, it must confirm that the gateway server is an authorized mail server for your domain.

To enable this, you need to add the SPF record to your domain.