Public Google Workspace evidence we can test
Google Workspace is relevant here for MX delivery, SPF, DKIM and DMARC for Gmail on a custom domain. The scanner does not sign in to the account; it compares the public-facing configuration associated with MX, SPF, DKIM, DMARC so a provider dashboard and the Internet-visible result can be checked against one another.
- MX — Read the public MX priorities and targets, then verify that each target itself resolves. A visible MX record is not enough if its mail hostname is broken.
- SPF — Inspect the single public v=spf1 policy, validate its terms and count DNS-query-causing mechanisms; duplicate policies or excessive lookups can invalidate SPF.
- DKIM — Use the selector configured by the sender or found in a DKIM-Signature header. Selector guessing is only a convenience and an empty guessed result is not proof that DKIM is absent.
- DMARC — Query _dmarc, validate the policy tags and distinguish publication from message-level alignment; a published record does not by itself prove every message passes DMARC.
Where Google Workspace changes normally belong
Google Admin console for service/verification values and the authoritative DNS provider for MX, SPF, DKIM and DMARC publication. Before editing that area, verify that Google Workspace actually controls the failing layer; a domain may use a different company for authoritative DNS, mail or the origin application.
How to interpret Google Workspace detection
MX and SPF can support a Google Workspace identification, but signatures are confidence-weighted. If the visible address belongs to a CDN/reverse proxy, the edge provider is reported as the edge and the hidden origin is not guessed. Mail-provider signatures likewise identify public routing, not private account ownership.
Common Google Workspace change points
MX delivery, SPF, DKIM and DMARC for Gmail on a custom domain most often breaks after a domain connection, nameserver move, website migration, certificate/HTTPS change or mail-DNS edit. For this provider, compare MX, SPF, DKIM with the value expected for the exact domain and account before replacing a working setting elsewhere.
Repair Google Workspace without widening the incident
Save the current public value, change only the setting tied to the diagnosis, and preserve unrelated working records. If DNS is not authoritative at Google Workspace, make the DNS edit at the provider named by the active nameservers. If Google Workspace owns only hosting or mail, leave the other service layers where they are.
Verify the Google Workspace repair
The public MX/authentication records should match the intended mail provider, required hostnames should resolve, and the relevant SPF/DKIM/DMARC check should no longer show the original failure. The verification should use the exact hostname/service repaired and should no longer depend on a control-panel “connected” indicator once the public check is available.
What a public scan cannot see inside Google Workspace
Billing state, private support actions, unpublished incidents, private origin addresses and authenticated account settings are outside a public diagnostic. HostWithShery reports those areas as unknown or a next support step instead of manufacturing certainty from a weak Google Workspace signature.
Technical references
These primary standards and provider documents are used to verify the behavior described on this page. Provider dashboards can change, so use the current official value for tenant-specific DNS records rather than copying an example from another account.