Google Workspace Integration
Connect your Google Workspace organization to automate DKIM management, discover email sources, and streamline authentication.
What You Can Do
DKIM Key Rotation
Automatically rotate DKIM keys on a schedule to maintain security.
Mailbox Discovery
Discover all users and groups that can send email from your domain.
Gmail Routing Analysis
Review Gmail routing rules that may affect authentication.
User Sync
Sync users from Google Directory for team management in DDMARC.
Prerequisites
- • Google Workspace subscription (Business Starter or higher)
- • Super Admin role in Google Admin console
- • Domain verified in Google Workspace
Setup Instructions
Navigate to Integrations
In your DDMARC dashboard, go to Settings → Integrations and find the Google Workspace card.
Dashboard → Settings → Integrations → Google Workspace → ConnectAuthorize with Google
Click Connect Google Workspace to start the OAuth flow. You will be redirected to Google to sign in and authorize DDMARC.
OAuth scopes requested:
gmail.readonly— Read email headers for authentication analysisadmin.directory.domain.readonly— Read domain configurationadmin.directory.user.readonly— Read user directory for team sync
Select Domains
After authorization, DDMARC will show all domains in your Google Workspace. Select which domains you want to manage.
Enable DKIM (Optional)
DDMARC can help you generate and publish DKIM keys for your Google Workspace domains. Click Configure DKIM to get started.
Key Rotation Scheduling
Enable automatic key rotation to maintain security. We recommend rotating keys every 6 months.
Google Workspace DKIM Setup
Google Workspace DKIM uses TXT records. Here is how to enable it through the Admin console:
Generate DKIM Key
- 1Go to Google Admin console → Apps → Google Workspace → Gmail
- 2Click "Authenticate email" in the left menu
- 3Select your domain and click "Generate new record"
- 4Choose 2048-bit key length (recommended)
After adding the DNS record, return to the Admin console and click "Start authentication" to enable DKIM signing.
Gmail Routing Rules
DDMARC analyzes your Gmail routing configuration to identify rules that might affect email authentication. Common issues include:
- Outbound gateway modifying headers
- Split delivery breaking DKIM signatures
- Third-party relays not configured for DKIM
Troubleshooting
Authorization fails with 'access denied'
Ensure you are signing in with a Super Admin account. Delegated admins may not have sufficient permissions.
DKIM authentication stuck on 'pending'
DNS propagation can take up to 48 hours. Use a DNS checker to verify the TXT record is visible.
Users not syncing correctly
Check that the admin.directory.user.readonly scope was granted during authorization.
Domain shows as 'not verified'
Complete domain verification in Google Admin console before connecting to DDMARC.