This is a checklist when you set up Google Workspace Email for your small biz so you cover the basics and fundamental security. The steps are in a chronological order for maximum speed.
Preparation #
- Ensure the domain has never been used with Google Workspace - ask client for verification. Google “remembers” if a domain was set up earlier and even if it wasn’t used, it still gets bound. If you need help, checkout - https://sanjayregmi.com/posts/fastest-way-to-release-your-domain-for-use-with-google-workspace/
Setup #
- Create account → use unique email (use + sign in your gmail address). First user = admin, auto-licensed.
- DKIM → Apps → Gmail → Authenticate email → add TXT → Start auth.
- Validate:
dig TXT google._domainkey.example.com @8.8.8.8
- Validate:
- DMARC → add TXT
_dmarcin DNS.- Example:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensics@example.com; adkim=s; aspf=s - Validate:
dig TXT _dmarc.example.com @8.8.8.8
- Example:
- Cloud Identity Free → Billing → Get more services → Activate.
- Turn off auto licensing → Billing → Subscriptions → Settings. Test with dummy user.
- Users → Create all, remove license from first admin, assign to real users, keep 2 admins (for backup).
- 2FA → Security → Overview → 2-Step Verification → enforcement → On from (choose a date, two weeks from now) → New user enrollment period → 2 weeks → Frequency, allow user to trust the device → Methods → Any except verification codes via text, phone call. Passwords Management: min 15–20 chars, enforce password policy at next sign in.
- Passkeys → Security → Authentication → Passwordless → Allow.
- Footer → Apps → Gmail → Compliance → Append footer (optional).
- Disable forwarding → Apps → Gmail → End User Access → Automatic forwarding → Off.
- Final check of DNS values - Run https://sanjayregmi.com/posts/find-dmarc-dkim-spf-nameservers-with-one-script/
Post setup - with users #
- Set up forwarding of existing email to workspace email.
- Set up Bitwarden. https://prasna.ca/use-password-manager-today/
Optional #
- Add company logo - Account –> Account Settings.
Checklist #
- Business address
- Domain access (Cloudflare, GoDaddy, etc.)
- Credit card for billing
- Names + usernames + current emails for all users
- Aliases needed (info@, sales@, etc.)
- Groups needed (support@ → multiple users)
- Notes / special rules
Google Workspace email setup request form #
Use this to collect data as noted on the checklist. https://tally.so/r/nP70NP
Advanced #
If you’re creating more than 50 users, consider using GAM - https://github.com/GAM-team/GAM. It gives you command line access to manage your Google Workspace. It’s incredibly powerful and open source.
🚁
