What this symptom usually tells you
Google Workspace can send or show an active account while public inbound routing is still wrong. The domain’s MX must point to the Google service expected for that tenant, and Gmail/service activation in the Admin console must also be complete. Stale competing MX records can route some senders elsewhere.
Evidence that narrows the cause
Use the live diagnostic to test the exact hostname involved. For this problem, the highest-value evidence is below. Treat each result as one piece of the business-email DNS and mail authentication diagnosis rather than as a standalone health score.
- Check MX — Read the public MX priorities and targets, then verify that each target itself resolves. A visible MX record is not enough if its mail hostname is broken.
- Check domain/Gmail activation — Verify check domain/Gmail activation from the public Internet and compare it with the value the responsible provider says should be live.
- Remove stale conflicting MX — Read the public MX priorities and targets, then verify that each target itself resolves. A visible MX record is not enough if its mail hostname is broken.
Record the current state before editing
Before changing business-email DNS and mail authentication settings, save the exact public values for check MX, check domain/Gmail activation, remove stale conflicting MX and note which hostname or mail path is failing. This creates a rollback point and prevents a later resolver cache, provider dashboard or unrelated working record from being mistaken for the original cause. Change one evidence-backed setting at a time, then compare the same signals again.
Safest repair path
Use the current MX value(s) shown by Google for the domain and publish them at the authoritative DNS provider. Remove obsolete MX entries from a prior mail host once the migration is intentional. Confirm the Gmail service/domain status in the Admin console separately from DNS.
How to confirm this specific repair
Public MX lookup should identify Google with no unintended competing mail exchanger, and each target should resolve. Send an external message to a Workspace mailbox and inspect Google’s email log/admin diagnostics if DNS is correct but delivery still fails.
A common wrong turn
Do not copy an outdated Google MX example when the Admin console provides a different current setup for the tenant. Provider documentation and the tenant’s assigned values take precedence over generic screenshots.
When to escalate with evidence
If these public checks match the provider's current documented configuration but the service still fails, give support the exact hostname, the observed business-email DNS and mail authentication result, a timestamp, and the failing network or message path. That separates a provider-side incident from a DNS change that has not actually become authoritative.
Technical references
These primary standards and provider documents are used to verify the behavior described on this page. Provider dashboards can change, so use the current official value for tenant-specific DNS records rather than copying an example from another account.