Configure Google Workspace

This topic explains how to set up Google Workspace (formerly G Suite) to route email through Sophos Gateway.

Add your domain and verify ownership

To add your domain in Sophos Central, do as follows:

1. Sign in to Sophos Central.
2. Go to My Products > General Settings > Domain Settings / Status.
3. Click Add Domain.
4. Enter your email domain details.

5. Configure your delivery destination.

   For delivery destination and port, enter MX, and the value routing-mx.<yourdomain.com> on Port 25. You configure your routing MX values after you verify domain ownership.

6. Next, click Verify Domain Ownership.

7. Copy the TXT value presented in the Verify Domain Ownership dialog.

   This value is specific to your email domain.

8. Create a TXT DNS record in the root level of the domain name (entered in step 5) and paste the TXT value copied in the last step. You can give it the same TXT name as shown or use @.

9. Once the new TXT DNS record entry is saved, click Verify.

When the DNS update with the correct TXT value has propagated, you receive a message indicating successful domain verification.

If the DNS update hasn't propagated, or the value entered is incorrect, you receive a failure message. Confirm that the value entered is correct.

Configure routing-mx values to deliver to Google Workspace

To provide failover for the inbound connection between Sophos Gateway and Google Workspace, you need to set up new MX records on a new subdomain of your mail domain.

In this example, we recommend using routing-mx.<yourdomain.com>.

How to configure this varies with different DNS providers. Typically you would enter the type as MX, the hostname as routing-mx, and the destination and priority as defined in Google's instructions.

• If you signed up for Google Workspace before 2023, you must have ASPMX.L.GOOGLE.COM as the highest priority record.

  

• If you signed up for Google Workspace in 2023 or later, you only need an entry pointing to SMTP.GOOGLE.COM.

Add mailboxes

You can now add mailboxes to Sophos Email Security. See Add mailboxes.

When you have added your mailboxes, continue with configuring your Google Workspace environment.

Restrict delivery to Sophos IP addresses

You can configure the connection to your mail host to only use our delivery IPs.

Restricting delivery IP addresses adds additional security to the integration between Sophos Email and your mail host.

The specific delivery IP address you need to use depends on the region where your Sophos Central account is hosted. When you created your Sophos Central account, you chose which country to store your data in.

To find out which IP addresses to use, see Sophos email gateway IP addresses.

DMARC failures from Google email servers

If you have turned on Time of Click URL Protection or End-user message settings in your email policies, you may see DMARC failures reported for inbound messages.

This is because Google doesn't consistently process emails from IP addresses in its Gateway IPs list.

Google's documentation says: "Gmail doesn't do SPF authentication for messages sent from IP addresses in the Gateway IPs list. The inbound gateway should do DMARC checks. DMARC authentication is bypassed for incoming messages from listed hosts." See Set up an inbound mail gateway.

Our tests show that this doesn't always happen, and Google marks some emails as DMARC failures when it shouldn't be doing DMARC checks. We have raised this with Google.

Create an Inbound Gateway in Google Workspace

Because you're using Sophos Gateway to filter your mail and have your MX records pointed directly to us, you need to restrict delivery to Google Workspace to only Sophos Delivery IPs.

To configure this setting, do as follows:

1. Sign in to your Google Admin Console.
2. In the Admin console, go to Menu > Apps > Google Workspace > Gmail > Spam, Phishing and Malware.
3. On the left, select your top-level organization. This is usually your domain.
4. Scroll to Inbound Gateway and click Edit inbound gateway.
5. Enter a description for your inbound gateway, for example Sophos Email Inbound Gateway.
6. In Gateway IPs, click Add.

7. In Add IP address/range, enter the Sophos gateway IPs that correspond to your region, and click Save.

   (Optional) You can also add IP addresses for Google's servers. There are reports that Google sometimes blocks its own IP addresses. To find Google's current list of IP addresses, see Obtain Google IP address ranges.

8. Turn on:

   • Automatically detect external IP (recommended).
   • Reject all mail not from gateway IPs.
   • Require TLS for connections from the email gateways listed above.

9. Click Save.

Changes can take up to 24 hours to take effect.

If you purchased your domain from Google, you must set up custom records as you can't edit the default DNS records that Google provides. See Set up Google Workspace with a third-party DNS host.

If you added a Google IP address in the optional step, Google might still block its own IP addresses. If this happens, you see the following message:

Google tried to deliver your message, but it was rejected by the relay xxxx.yyyy.google.com. We recommend contacting the other email provider at postmaster@xxxx.yyyy.google.com for further information about the cause of this error. The error that the other server returned was: xxx.xxx.xxx.xxx IP not in whitelist for RCPT domain, closing connection.

Google's suggested solution is to turn off Reject all mail not from gateway IPs. We recommend you do this temporarily, until the issue is resolved. While this setting is turned off, email senders can route email directly to your email gateway if they don't use MX lookup.

Change your MX records to point to Sophos Gateway

Changing your domain's MX records to point to Sophos Gateway is crucial to successful deployment and ensures all email is filtered and delivered.

If you can't make these changes yourself, contact your IT department, hosting provider, ISP, or Domain Name Service provider and arrange for the MX records for your domains to be modified.

When you created your Sophos Central account, you selected a region where you wanted to store your data. Your MX records are dependent on this region.

Change your MX records to include the record names associated with the region where you chose to store your data.

To find out which MX records to use, see Sophos MX records.

Notes

Take care with all options to ensure that the spelling and numbers are correct.

Using MX record names other than those provided prevents mail from flowing correctly.

When changing DNS entries like MX records, we recommend lowering the TTL (to 600 ms or less) well in advance of updating the entries. This allows the change to propagate quickly and provides a quick way to revert changes, if any issues arise during testing.

Create Google Workspace rule for internal messages

By default, all your messages are sent to Sophos Gateway, using the destinations set in your inbound MX records. You must create a routing rule in Google Workspace to direct internal messages to Google servers instead.

To create the rule, do as follows:

1. Sign in to your Google Admin Console.
2. In the Admin Console, go to Menu > Apps > Google Workspace > Gmail > Hosts.
3. Click ADD ROUTE.
4. Enter a route name that helps you remember the route, for example Internal Messages.
5. Select Multiple hosts.

6. Enter the Primary host details as follows:

   Option	Value
   Hostname	aspmx.l.google.com
   Port	25
   Load	100%

7. Enter the Secondary host details as follows:

   Option	Value
   Hostname	alt1.aspmx.l.google.com
   Port	25
   Load	100%

8. Select Require mail to be transmitted via a secure transport (TLS) connection (Recommended), then select Require CA signed certificate (Recommended).

9. Click SAVE.
10. Go to Apps > Google Workspace > Gmail > Routing.

11. Scroll to the Routing setting, then do one of the following:

    • If you haven't configured a rule yet, click CONFIGURE.
    • If you've already configured a rule, click ADD ANOTHER RULE.

12. Enter a name for the routing setting, for example Internal Emails Route Rule.

13. In Email messages to affect, select Internal - Sending.
14. In step 2, select Modify message from the drop-down list and select Change route.

15. Click Show options and make sure the following account types are selected:

    • Users
    • Groups

16. Under option C, Envelope filter, select Only affect specific envelope senders, select Pattern Match from the drop-down list, and enter your domain in the Regexp field. For example, example.com.

17. Click SAVE.

    Changes can take up to 24 hours to take effect. You can track changes in your Google Workspace Admin audit log.

Test and confirm email flow

Once you've updated your MX records, send a test message to any of your mailboxes protected by Sophos Gateway. Send your test message from an address outside your email domain.

To confirm the message flowed through Sophos Gateway, you can view the Message History report.

To access the report, do as follows:

1. Sign in to Sophos Central.

2. Go to Reports > Message History.

   If messages are flowing through the system, you see entries in this report.

If mail isn't flowing, you aren't receiving email to your test inbox. Take the following steps:

1. Verify that your MX records are correct for your region.
2. Verify that you set up the Sophos Delivery IPs correctly in your gateway, firewall, or connector.
3. Verify that the mailbox you're sending to exists in Sophos Email Security.

If you've taken all these steps and mail still isn't flowing for your domain, contact Sophos Support.