How to configure Sophos Email for Google Workspace

1. Click Email Gateway > Settings.
2. Click Domain Settings/Status.
3. Click Add Domain.
4. Enter your email domain details.
5. Configure your delivery destination.
   1. For delivery destination and port, enter MX, and the value routing-mx.<yourdomain.com> on Port 25. You configure your routing MX values after you verify domain ownership.
6. Next, click Verify Domain Ownership.
7. Copy the TXT value presented in the Verify Domain Ownership dialog.

   This value is specific to your email domain.

8. Create a TXT DNS record in the root level of the domain name (entered in step 5) and paste the TXT value copied in the last step. You can give it the same TXT name as shown or use @.
9. Once the new TXT DNS record entry is saved, click Verify.

To provide failover for the inbound connection between Sophos Email and Google Workspace, you need to setup new MX records on a new subdomain of your mail domain.

In this example, we recommend using routing-mx.<yourdomain.com>.

Note This is different to configuring the MX records for mail delivery on your domain itself. Adding these records has no impact on mail traffic yet, these records are just used for the delivery destination configured within Sophos Email.

How to configure this varies with with different DNS providers. Typically you would enter the type as MX, the hostname as routing-mx, and the destination and priority as per the Google URLs in the screenshot below. You must have ASPMX.L.GOOGLE.COM as the highest priority record.

Note You can miss out this step and configure the delivery destination to point directly to ASPMX.L.GOOGLE.COM. But if there's an issue contacting ASPMX.L.GOOGLE.COM, mail won't be delivered to Google's alternate MX server.

Sophos Email allows you to add single mailboxes manually via the user interface.

1. Go to Email Gateway > Mailboxes to view and manage your mailboxes.
2. On the Mailboxes screen, click Add.
3. Select Add Mailbox.

   There are three types of mailbox:

   • User Email: a mailbox for a person. Example: firstname.lastname@companyname.com.
     Tip For a User Email mailbox, you can click the mailbox name to view the user's details.
   • Distribution List: a mailbox for a group of people. Example: support@companyname.com.
   • Public Folder: a mailbox for collecting information such as surveys or feedback. Example: survey@companyname.com.
4. Select a mailbox type.
5. Enter a name for the mailbox.
6. Enter the SMTP address for the mailbox.
7. Click Save to create a single mailbox and exit, or Save and Add Another to create additional mailboxes.

Sophos Email allows you to add mailboxes in bulk mailbox import.

1. Create your import .csv file using the following format:

   Name	Email Address	Type
   Robert Alamar	robert.alamar@test.com	User
   Support DL	support@test.com	DL
   Vacation Calendar	vacation@test.com	PF

2. Click Add Mailbox and select Import mailboxes.
3. Click Browse and go to your import file.
4. Click Add to start the import process.

   The import runs and displays the results when complete.

Because you're using Sophos Email to filter your mail and have your MX records pointed directly to us, you need to restrict delivery to Google Workspace to only Sophos Delivery IPs.

1. Sign in to your Google Admin Console.
2. Navigate to Apps > Google Workspace > Gmail > Advanced settings.
3. In the Organizations section, select the top-level organization.
4. Scroll to Inbound Gateway in the Spam section.
5. Click Configure.
6. Enter a description for your inbound gateway, for example Sophos Email Inbound Gateway.
7. Under Gateway IPs, click Add and enter the gateway IPs that correspond to your region. You must save after each entry.
8. Turn on:
   • Automatically detect external IP (recommended).
   • Reject all mail not from gateway IPs.
   • Require TLS connections from the email gateways listed above.
9. Click Add Setting or Save.
10. Click Save again at the bottom of the page.

1. Sign in to Google Admin with your administrator account.
2. Go to Apps > Google Workspace > Gmail > Hosts.
3. Click Add Route.
4. Enter a route name that helps you remember the route, for example Internal Messages.
5. Select Multiple hosts.
6. Enter the Primary host details as follows:

   Option	Description
   Hostname	aspmx.l.google.com
   Port	25
   Load	100%

7. Click Add Primary.
8. Enter the Secondary host details as follows:

   Option	Description
   Hostname	alt1.aspmx.l.google.com
   Port	25
   Load	100%

9. Click Add Secondary.
10. Select Require mail to be transmitted over a secure transport (TLS) connection (Recommended).
11. Select Require CA signed certificate (Recommended).
12. Click Save.

    Changes can take up to 24 hours to take effect. You can track changes in your Google Workspace Admin audit log.