Collapser — setup guide 01 of 02

Your home Workspace. Five records and a checkbox.

The one org that holds every domain you own, where you're the only person. Everything else hangs off this.

Home WorkspaceSignaturesSecondary domainsYour other identitiesOther people
SubdomainTypeValue
01
— leave blank —
TXT
google-site-verification=…
Proves you own the domain. Google hands you the string. Blank, not @ — Vercel takes an empty field literally and @ would become a subdomain called "@".
02
— leave blank —
MX
smtp.google.com  ·  priority 1
Sends your mail to Google. One record, that's the whole thing now. Leave the subdomain empty even though Vercel's form looks like it wants a value. Empty means the bare domain. Delete every other MX on the domain. A leftover at a higher number is a trapdoor mail falls through when Google blinks. Not sure which are there? Check the domain and it lists every MX by name, so you know exactly what to remove.
03
— leave blank —
TXT
v=spf1 include:_spf.google.com ~all
Says Google is allowed to send as you. One SPF record per domain, ever — if one already exists, merge into it rather than adding a second.
04
google._domainkey
TXT
v=DKIM1; k=rsa; p=MIIBIjANBgkq…
The signature that proves it's really you. Generate it in the Admin console — it's unique per domain and Google won't give it to you until Gmail's been live a day or so. Skipping this is the mistake. Everything works without it until it silently doesn't.
05
_dmarc
TXT
v=DMARC1; p=none;
Tells the world what to do if the checks fail. Start at none— it watches without breaking anything. Tighten it once you've seen a month of clean mail.
Your nameservers don't move. These five records go wherever your DNS already lives — Vercel, in this case — and your site keeps serving exactly as it does now. Nothing about this is a migration. Check what a domain publishes today →

The clicks.

  1. Sign up — and start fresh

    workspace.google.com → Get started. Business name, "just you" for size, and the domain you already own.

    The forkGoogle offers to link your existing personal Gmail instead. Don't. Your personal account has years of Photos, purchases, and account recovery hanging off it, and this fuses that into an org you administer. Start fresh, keep the boundary.
  2. Pick Starter, pay monthly

    Business Starter has every single thing this needs: custom domain, secondary domains, aliases, DKIM. $7 a month on a year's commitment, $8.40 monthly.

    Two trapsThe signup flow defaults to Standard at twice the price — look for the plan comparison. And take monthly at first: annual locks your license count and bills the remaining balance if you leave early. Switch once it's boring.
  3. Verify the domain

    Google gives you record 01. Add it, come back, verify. Usually under a minute.

  4. Activate Gmail

    Back in Manage domains, hit Activate Gmail. This is where record 02 comes from. Add it — then go look at what else is on the domain.

    Old wiringIf you ever pointed this domain at a forwarder, an old MX is still sitting there at a higher number. Mail will use it the moment Google is unreachable, and it'll land somewhere you stopped looking years ago. Delete it now, while you're already in the panel. If you're not sure what's there, the dashboard reads your live DNS and names every stray record to remove, MX and leftover TXT alike.
  5. Add SPF

    Record 03. Nothing to generate — it's the same line for everyone using Google.

  6. Generate DKIM, then start it

    Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate a 2048-bit key, paste it at google._domainkey, wait for DNS, then come back and click Start authentication. If Vercel warns that this record overrides a wildcard entry, say yes. DKIM is looked up at that exact name, so the specific record is the one you want. Everything else still falls through to the wildcard.

    Two ways to get this wrongGoogle may refuse to generate a key for the first day or two after activating Gmail. That's normal, come back tomorrow. And generating the key is not turning it on. "Start authentication" is a separate click, and it's the one everybody forgets.
  7. Add DMARC and stop

    Record 05, set to p=none. It reports without enforcing, which is what you want while you're still moving things.

How you know it actually worked.

The Admin console will tell you everything is fine well before it is. The only real proof is a message that left your domain and arrived somewhere else. Send one from an outside address, reply to it, and open the reply's original.

Mail arrives

Send from an account that isn't this one. If it doesn't land within a few minutes, MX is wrong or DNS hasn't caught up.

The reply is signed as your domain

In the received copy, the signature should name your domain — not Google's, not anyone else's. If it names something else, DKIM was generated but never started.

All three checks pass

SPF, DKIM, and DMARC should all read as passing. Two out of three is not a pass — it's a thing that works today and stops working when a recipient tightens their rules.

No "via" and no "on behalf of"

If the recipient sees either of those, the message is wearing a costume rather than being you. That's the whole point of the four records above.

The things that go wrong.

"This domain is already in use"

A domain lives in exactly one Google organisation, ever. If you half-started a Workspace on it once, or bought it through a Google partner, or someone set one up years ago — it's spoken for, and Google will refuse to let you create a second one without explaining why.

Sign in with whatever account you'd have used back then and look at admin.google.com. Either you already own the thing you're trying to build, or you'll find the account holding it hostage.

Blank versus @ in the subdomain field

DNS has a convention where @means "the domain itself." Some control panels expect it. Some don't, and will take it literally.

Vercel wants the field empty. Type @and you'll create a record for a subdomain named "@", which resolves to nothing and gives you no error — just a verification that never completes and no clue why.

The tell: after saving, the panel should show the record against your bare domain. If it shows anything else, that's the bug.

Why one MX is enough, and two is dangerous

MX records have priority numbers, and lower wins. Everything else is a fallback for when the first one can't be reached.

That sounds like insurance. It isn't. A leftover MX from an old forwarder means that on the day Google has a hiccup, your mail quietly goes to a service you forgot you had — and you won't find out, because nothing failed. It succeeded, somewhere else.

Google needs exactly one MX now. Anything else on the domain is old wiring. Pull it.

What DKIM is actually doing

Two things prove a message really came from your domain. One checks the servers it passed through. The other is a signature Google applies to the message itself, using a key only it holds, which anyone can verify against the public half you published in DNS.

The first one is fragile — it breaks the moment mail gets forwarded, because the path changes. The signature doesn't. It travels with the message.

That's why DKIM is the record that matters. It's what lets you send as six different addresses from one mailbox and have every one of them verify. Without it you're relying on the fragile check alone, which works right up until it doesn't, and then your mail starts quietly failing at recipients who take it seriously.

Why 30GB is the number to watch

Starter gives you 30GB, and it's shared across Gmail, Drive, and Photos rather than 30GB each.

As a mail-only inbox, that's years — mail is small. It stops being years the moment you start treating this as your main Drive.

Worth knowing now because this is about to become the address you give people for the rest of your life. Upgrading later is a click, but running out is discovered at the worst moment.

Then the domains start arriving free.

What you just built is the expensive part, and it's the only expensive part. Every other domain you own gets added to this same org as a secondary domain, costs nothing, and hangs its addresses on the mailbox you now have.

Same five records each. Different verification string, same everything else. Guide 02.